Set permissions in ad to allow only certain user accounts to logon

[angels1]

I know a can set on the user account to which machine a user can logon to but can I set permissions on a computer itself to only let 2 users to sign on and deny all others

 

[xmsre]

Put the target computers in their own OU, then create a group policy that defines the "log on locally" permission and apply it to the OU.

 

[angels1]

Thanks Very much