Is there any method in domain network that only prevent " local users account(clients local user) " log on?

Question

I've been looking for a method in domain network to only prevent " local users account(clients local user) " log on ? **( but "domain users account" must still could be log on in clients)**

I try to do this with "deny log on locally" policy through group policy management but there is no group for "local users account" however we can add "domain users" group to this "deny log on locally" policy and then domain users can't log on in workstation, Is there such group for "local users" ????

Answer 1

I don't think you can control non-domain users from domain policy. Simply do not put any local users on those computers other than an admin user that only you know the password for. Then they should not be able to log in locally if they do not know that local admin password, they would only be able to log into the domain and domain policy could control what they do there.

Answer 2

You do NOT set up local users on ANY machine, except one administrator for setting up. On a domain you can let domain users log into ANY machine that is joined to the domain,.Do NOT make ANY user a domain user.

Answer 3

thanx for responding,but I have local users in clients that I want to don't allow them log on locally from server policy