Disbale account group policy - Urgent

[pettit87]

We have created parental account in AD to they can authenticate to the school website to see their son/daughters information stored in an information delivery system. We need this accounts to be enabled so they can authenticate but do not want the parents to be able to log into an domain computer. is there a group policy that will do this?

[Jamman960]

Yep, within group policy go to Computer Configuration > Windows Settings > Local Policies > User Rights Assignment and then find the "Deny Logon Locally" option and add either a group or user to the list. As usual this would need to be applied to a workstation OU.