Configure the user right for "deny logon locally" to those users or groups
but do NOT use everyone/users as administrators are members of those groups
also. That user right is in the appropriate security policy under security
settings/local policies/user rights. --- Steve