Denying logon to an administrative account

Question

I'm trying to find a way for user accounts that are used to elevate privileges cannot be logged on to. Like "Deny local logon"
but with the added benefit of elevating a command prompt with that account.
Anything like this exist in GPOs? Or any other kind of solution that can give me the same results?

Answer 1

Hi,
To deny logon access at the domain level to service administrators,
please try the following steps:
Log on with Domain Admins credentials, and then open Active Directory Users and Computers.
In the console tree, right-click
domain name, and then click
Properties.
On the
Group Policy tab, click
Default Domain Policy, and then click
Edit.
Expand the policy tree to Computer Configuration\Windows Settings\Security Settings\Local Policies, and then click
User Rights Assignment.
In the details pane, double-click
Deny logon locally.
Click
Define these policy settings, and then click
Add.
Add all of the service administrator accounts (Administrators, Schema Admins, Enterprise Admins, Domain Admins, Server Operators, Backup Operators, and Account Operators) to the
list.
Also, follow the procedure as below for restoring logon capability to administrators so that they can log on to administrative workstations.
Allowing Logon Access to Administrative Workstations
http://technet.microsoft.com/en-us/library/dd379005(v=ws.10).aspx
Hope this helps,
Ada Liu