GPO: Deny Logon Local
Follow these steps to modify which users/computers can access a computer.
Computer Configuration\Policies\Security Settings\Local Policies\User Rights Assignment
- “Allow log on locally” => Any accounts that will have access
- “Deny access to this computer from the network” => Add:
Local accounts and Guests