How to prevent user from logging on to computers in an OU?

[Gerry]

Just had this query from a room supervisor and I'm not sure if it's possible. He would like to be able to prevent a user from logging-on to the PC's in two IT rooms, but not prevent them using PC's elsewhere. All our PC's are organised into OU's.

[sted]

gpo on the associated ou

computer settings\windows settings\security settings\user rights assignment\deny log on locally

add users/groups here