Deny Domain Admins Local Logon: Step-by-Step

This guide shows you how to prevent Domain Admins from logging on locally to your Windows servers and workstations. By applying a Group Policy that explicitly denies interactive logon rights to the Domain Admins group, you reduce the risk of credential theft and lateral movement. You’ll need access to a domain controller with Group Policy Management Console (GPMC) installed, and an account with permissions to create and link GPOs.

What You’ll Need

• A Windows Server with Active Directory Domain Services (AD DS) and the Group Policy Management feature installed.
• An account that is a member of Domain Admins or has delegated rights to create and link Group Policy Objects (GPOs).
• Administrative access to at least one test client or server to verify the policy.
• A clear list of the OUs (Organizational Units) where you want to apply the policy (e.g., Servers, Workstations).

Step-by-Step

1. Open Group Policy Management Console: On your domain controller, click Start, type gpmc.msc and press Enter. If you’re not on a DC, install RSAT tools first.
2. Create a new GPO: In the left pane, right-click your domain (or the OU where you want the policy to apply), and select Create a GPO in this domain, and Link it here. Name it something like “Deny Domain Admins Local Logon”.
3. Edit the GPO: Right-click the new GPO and choose Edit. This opens the Group Policy Management Editor.
4. Navigate to the correct policy setting: Go to Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment.
5. Open the “Deny log on locally” policy: In the right pane, double-click Deny log on locally. This is the policy that explicitly blocks a user or group from logging on at the physical console (or via RDP if you also deny remote logon).
6. Add Domain Admins: In the properties window, check Define these policy settings, then click Add User or Group. Type Domain Admins and click Check Names to resolve it, then OK. The group will appear in the list.
7. Apply and close: Click OK to save the policy. Close the Group Policy Management Editor.
8. Link the GPO to the desired OUs: In GPMC, drag the GPO onto the OUs that contain your servers and workstations. If you created it at the domain level, it’s already linked to the whole domain.
9. Force a refresh (optional): On a test machine, run gpupdate /force from an elevated command prompt to apply the policy immediately. Otherwise, wait for the next background refresh (typically 90 minutes).
10. Verify the policy: Log off the test machine, then try to log on locally with a Domain Admin account. The logon should be denied with a message like “The sign-in method you’re using isn’t allowed.” If it succeeds, the policy hasn’t applied—check the steps below.

Common Mistakes

• Applying to the wrong OU: If you link the GPO to an OU that doesn’t contain the computers you want to protect, the policy won’t take effect. Remember that user rights policies are computer settings—they apply to the computer, not the user.
• Using “Allow log on locally” instead of “Deny”: The default “Allow log on locally” already includes Administrators, which includes Domain Admins. To explicitly block, you must use the Deny policy. Deny settings override allow settings.
• Forgetting to define the policy: If you don’t check “Define these policy settings”, the GPO won’t enforce anything—it just shows the default state.
• Blocking all admins by mistake: If you add the “Administrators” group instead of “Domain Admins”, you’ll lock out local admins too. Be precise with the group name.
• Not testing before rolling out: Applying this to all servers without testing can lock out legitimate admin access if you make a mistake. Always test on a pilot OU first.

Tips

• Use a separate GPO for remote logon: If you want to allow RDP but block console logon, configure “Deny log on through Remote Desktop Services” separately. This guide only covers local (console) logon.
• Consider using a “break-glass” account: Create a dedicated emergency admin account that is NOT in Domain Admins but is in a group that has local admin rights on servers. This gives you a fallback if something goes wrong.
• Apply to OUs, not the domain: Linking to specific OUs (like “Servers” and “Workstations”) gives you more control and avoids affecting domain controllers, where you might still need local logon for recovery.
• Document your change: Note the GPO name, the date, and the OUs it applies to in your change log. This helps with audits and troubleshooting.
• Use security filtering: By default, the GPO applies to all computers in the linked OU. If you need to exclude certain machines, add a WMI filter or change the security filtering to only specific groups (like “Domain Computers” but not “Domain Controllers”).

Troubleshooting

If the policy isn’t working, follow these checks:

• Verify GPO application: Run gpresult /r on the affected computer to confirm the GPO is listed under “Applied Group Policy Objects”. If it’s not, the GPO may not be linked to the computer’s OU, or security filtering is blocking it.
• Check the order of GPOs: If another GPO later in the processing order has “Allow log on locally” with Domain Admins, it could override the deny. Deny settings generally win, but check for conflicting policies.
• Confirm the group name: In the policy, the group should appear as “DOMAIN\Domain Admins”. If you typed it manually and it didn’t resolve, the SID might be wrong. Remove and re-add using Check Names.
• Force a refresh and restart: Some user rights changes require a reboot to take effect. After running gpupdate /force, restart the test machine if the policy still doesn’t apply.
• Check event logs: On the client, look in Event Viewer under Windows Logs → Security for logon failure events (ID 4625) that show the reason for denial. This confirms the policy is being enforced.
• Test with a non-admin account: If a regular user can log on but a Domain Admin can’t, the policy is working. If neither can log on, you may have accidentally blocked all users—check the policy settings again.

Frequently Asked Questions

Does this prevent RDP logons?

No. “Deny log on locally” only affects console logons (physical keyboard/mouse). To block RDP, you need to also configure “Deny log on through Remote Desktop Services” in the same GPO.

Will this affect domain controllers?

Only if the GPO is linked to the Domain Controllers OU. By default, domain controllers are in a separate OU and won’t receive the policy unless you link it there. It’s generally recommended to keep this policy off DCs to avoid lockout during recovery.

Can I use this to block a specific user instead of a group?

Yes, you can add individual user accounts to the deny list. However, using groups is easier to manage and less error-prone.

How long does it take for the policy to apply?

Group Policy refreshes every 90 minutes by default, with a random offset of up to 30 minutes. You can force an update with gpupdate /force on the target machine.

What if I lock myself out?

If you accidentally block all admin access, you can log on with a local account on the machine (if one exists) or use a recovery console. On a domain controller, you can boot into Directory Services Restore Mode (DSRM) to revert the policy. Always have a break-glass account ready.

Does this apply to Windows 10/11 workstations?

Yes, the policy works on all current Windows client and server versions. The path in the Group Policy editor is the same.

Related

• Pause or Cancel WoW Payments During a Content Gap
• What Is a Cell Reference? Excel & Sheets Guide
• Standalone vs Embedded Charts: Key Differences