I've been looking for a method in domain network to only prevent "local users account(clients local user)" log on ( but "domain users account" must still could be log on in clients)
I try to do this with "deny log on locally" policy through group policy management but there is no group for "local users account" however we can add "domain users" group to this "deny log on locally" policy and then domain users can't log on in workstation, Is there such group for "local users" ????
in "Allow log on locally" policy dialog box in "default domain controller policy" in explain tab it is mentioned that this policy by default apply on following users
default on workstation & server: administrators,backup operators,users.
default on domain controller: administrators,backup operators,print operators,server operators.**
According to this defaults I think there should be a way to define such client local users group in "deny log on locally" policy but every time that I want to add any of this local users group to "deny log on locally" policy the system only identified domain group or "server local user" for example when I type "users" in the "add user & group" box in "deny log on locally" policy the system identify it as group of "server local user " and not the "client(workstation) local users" then as a result of this setting I could not even log on in my server with administrator account !
Here are some method that I try and doesn't work for me (all client was joined to domain and ping domain name & server)
I try to add computer-name in "default domain controller policy" in the "add user & group" box in "deny log on locally" policy and when I press check-name button it added with name of "domainname\computername$ " but doesn't any effect and still all user can log on in that computer.
I try to add computername\localusername in the "add user & group" box in "deny log on locally" policy but when I press check-name button it didn't even identify such client.
I know (and I did) that in the "add user & group" box must click on browse button and then object type and check computers