Hi all, I'm in need of some help. We've recently begun deploying Windows 7 Enterprise throughout our organization (It's a Hospital btw). The head Nurse has a problem with the doctors logging onto the system we've assigned to them (the doctors have their own pc, yet they still continue to use the nurses') and has requested of us if some sort of permission could be implemented to bar them logging on. The only solution I've found thus far is to bar the users using the "Deny log on locally" local group policy on the machine and either add the user or OU that needs to be barred. Does anyone know of another way to do this, or is this the only option that exists?

Using the User Rights of "Allow Logon Locally", and "Deny Logon Locally" are the best ways to address this situaiton. Alternatively, if you wanted to restrict a user to a specific set of computers for logging on to the domain, you go to the User's Account properties in Active Directory, go to the Account Tab, and click on the "Logon To" button. Type the names of the computers you want to allow this user to logon to. Visit: anITKB.com, an IT Knowledge Base.

Great!! Thanks much for the response and advice!