There is no setting in GPO to do such. You can configure a users account in AD
to be able to logon to just specific domain computers and use security policy to
configure the logon locally user right. Other than that you would need a third
party solution or look into using cconnect from the Resource Kit which requires
the use of a client component and a sql server. --- Steve