blackwatch

You are concerned only with allowing locally? If so, simply allowing those two groups, should deny (or at least not allow) everyone else. Anyone else should get an error that they are not allowed to logon interactively.

Unless I'm misunderstanding the situation, you should be able to allow local logon under Local Computer Policy | Computer Configuration | Windows Settings | Security Settings | User Rights Assignment | Logon Locally. Hope it helps a little.

Greetings, I am Blackwatch, a computer geek from the great area of New England. I'm married with 2 kids. No pets. I like computers, the outdoors, and cutlery (I collect knives). I found this forum just today. I will happily come back here to learn or help (if I can) others with issues. Take care.