I have a group policy applied to a userOU in AD, after 5 log on failures user accounts are locked out for 30 min. I have discovered if a user account is locked out, he or she can still log on locallyto the clientPC but can't access any domain resources ( shares, shared printers, etc). How do I stop users from logging on when thier account is locked, which part of a GPOwill fix this issue.

Hi, Since here is the forum for Exchange,I recommend you to use Newsgroup for Active Directory to get relevant help. Discussions in Active Directory http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.windows.server.active_directory&cat=en_US_09e458e2-5a48-4d89-a40f-847f472bc08e&lang=en&cr=US Besides,you can refer to the article below: How to assign scripts in Windows 2000 http://support.microsoft.com/kb/322241 Hope it helps. Xiu