logon policy settings before and after joining domain

[crogte]

I have a set of workstations in conference (public areas), which I want to restrict logons to only one local user, which I have set up to log on automatically. I have decided for administrative purposes that I would like to have them on my NT4 domain (yeah, I know). This causes a problem in that, once these workstations join the domain, any domain user can log into them. I don't want my users to be able to access network resources because they will not remember to logoff afterwards. Brings me to my question....

How can I set logon policies to deny "mydomain\domain users" logon privs? I do not want to use the gui for gpedit, because I need my helpdesk folks to be able to reload these boxes without any thought (tgfg). This is the last remaining detail of that dream. If I can find a command line process to set these policies, I'd be a happy camper.

 

[crogte]

Ok...I found it:

There is a utility in the 2000 resource kit called ntrights.exe.

Using the following in a script, I was able to deny 'users' the ability to log on to the box:
ntrights -u users -r SeInteractiveLogonRight

supporting docs:

http://support.microsoft.com/?kbid=315276

http://www.microsoft.com/technet/tr...prodtechnol/winxppro/reskit/prnd_urs_wyxu.asp