Deny Log on Locally

[itd17]

If I define this in my GPO, does this also disallow access from Administrators?

 

[tfg13]

Depends. Are you talking about local administrators of the machine (like domain admins which should be local administrators of the machine, not just the domain)? Are you assigning "Deny Logon locally" to Everyone, or Authenticated users?

 

[itd17]

I only want to allow domain/local admins access and deny everyone else.

 

[tfg13]

I would set the GPO, then, not allow administrators the ability to "read and execute" the GPO.