This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hi
I want to avoid users to logon locally,
I have find the GPO for do this , How I do that for local users?
Grateful for answer
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 96%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EFF%3C/text%3E%3C/svg%3E)
Hi，
I am checking to see if the problem has been resolved.
If there's anything you'd like to know, don't hesitate to ask.
Best Regards,
Hi,
As this thread has been quiet for a while,
If this question has any update?
If you have any questions or concerns about it, please don't hesitate to let us know.
Best Regards,
Hi,
Yes , there is a group policy to do this.
For example , there is a local user local18.
I create a gpo and link it to the computer container or you can do this through local group policy.
Right click it and select edit, and find the policy under computer configuration>windows settings>security>local policies>users right assignment>deny logon locally
type the user name directly as following:
Refresh the policy on the client.
Best Regards,
Hi FanFan-MSFT,
the problem with your solution is: The GPO doesn´t work in general conditions. The better way to solve is:
create a Security Group on EVERY client, call it "LogonLocallyDeny", can be done easily by GPP Local Users and Groups
Use the policy you mentioned and define the created group "LogonLocallyDeny"
Now you only need to integrate users into groups, It´s the same handling like "Remote Desktop User" or "Administrators" Group. You can define a local group for every permission you want to grant: LogonRDPDeny, LogonLocallyAllow etc.
Mark
Users into Groups can be handled aswell by GPP LUaG, using Item Level Targeting or by using variables for groups in Active Directory.
Think of a group like: YOURPCNAME-Admins and via GPP you integrate "%computername%-admins" into the Administrators group. That can be used for all other local permissions group we create. Or probably you create site or organisation variables with GPP Environment ... and so on.
Mark