Hi all
Recently I receive task in my company to add all local machine guest accounts to policy deny logon locally. This of course would not be a problem but this setting is inherited from domain so I am unable to add this account via gpedit.
I tried to create local machine group denylogonlocally and add guest account to it. Then in domain I created global group gg_denylogonlocaly and add it to domain GPO setting Deny Logon Locally. The problem is that I can not add denylogonlocally group from machine to gg_denylogonlocaly. After doing some search it seems that it is impossible to add local machine group to domain group but domain group can be member of local machine group. But this wont be solution because local machine group can not be added to GPO setting Deny Logon Locally - it is inherited from domain :/.
Is there any solution to add local account to GPO setting that is inherited from domain ?