Restrict local user login via GPO

Question

I need a way to restrict domain user's access to the PCs in my department. All users at the company are put into company wide general user groups and then, as a department, we put them into separate user groups per department OU. I want to restrict access
to all users except the users in my OU user groups but there are hundreds of other user groups created by other departments so direct exclusion per group is out. I need a way to restrict everyone except my users via a group policy object. 
Any help is appreciated.

Answer 1

Hi,
Please follow the below steps for denying logon to all users, except the users who are the members of groups in your department OU,
1. Create a new group called "MyExcludedGroups" (To whom we are going to add the groups, for excluding logon to your department computers).
2. Check the below steps for adding the groups to "MyExcludedGroups" group using powershell,
- Go to Start -> Open Windows Powershell using Run as Administrator 
- In the powershell type, set-executionpolicy unrestricted (for allowing commands to execute)
- Type the command import-module activedirectory           (to enable and execute AD cmdlets)
- For example to add the groups in "ou=test1,dc=mydomain,dc=com" to "MyExcludedGroups" group, type the below commands,
           $test1=Get-ADGroup -Filter * -SearchBase "ou=test1,dc=mydomain,dc=com" 
           Add-GroupMember -Identity MyExcludedGroups -Members $test1
      Similarly you can run the commands on each OU to add the groups to "MyExcludedGroups" group.
3. Create a Group Policy Object (GPO) linked at the OU containing your department computers called "Deny Interactive Logon".
4. Right click and edit the GPO "Deny Interactive Logon" and navigate to the node "Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment".
5. In the "User Rights Assignment" node add "Deny log on locally" permission for "MyExcludedGroups" group.
Regards,
Gopi
www.jijitechnologies.com