I created a batch file to remove "domain\Domain Users" from the Allow Log On Locally local security policy and replace it with "domain\username". This works. This is my script:
First, remove the unwanted group:
C:\ntrights.exe -r SeInteractiveLogonRight -u "domain\domain users"
Second, add the user:
C:\ntrights.exe +r SeInteractiveLogonRight -u "domain\username"
When I test by updating the machine's policy with the command "gpupdate /force", the Allow Log On Locally setting reverts back to default policy and the "domain\Domain users" entry comes back.
I want to remove the "domain\Domain users" entry and not have it return to the default policy, even if
gpudpate /force is run.
I have Windows 7.