Allow only certain group of users to logon

[ljCharlie]

Is there a policy in the local security policy for allowing only certain groups of users to logon interatively? If so, where do I find it? Thanks!

[doctorgonzo]

If you go to Control Panel...Administrative Tools...Local Security Policy, it should be under User Rights Assignment. If you don't want certain people to log in, you can add them to the "Deny logon locally" group.

[ljCharlie]

I see that, but I don't know who else I want to deny. I only know who I want to allow. So will the Logon localy policy work in this case if the user is authenticated through a domain server?

[doctorgonzo]

No, I don't think it applies to domain accounts. You are going to have to set up a Group Policy or something like that if you want to restrict access; I don't administer a Windows server environment so I'm not sure exactly what you would need to do.

[ljCharlie]

I think I just got it to work using the Allow logon locally policy.

[faulkner132]

By default Workstations in a domain will only allow logon for local user accounts and Domain Admin accounts. If you want a Domain User to log in who is not an admin, you have to manually assign them rights to log onto the machine.