I'm looking into doing some "Run As" stuff for users that don't deserve local admin but need it for app's like OmniPage. Everything looks pretty straight forward but I'm wondering now, what can I do to keep these users from logging in under the "run as" account? I tried denying log on locally but that prevented the app account from being used while logged in as someone else. Suggestions?