Windows 10: Deny Users and Groups to Sign in Locally to Windows 10

How to: Deny Users and Groups to Sign in Locally to Windows 10

How to Deny Users and Groups to Sign in Locally to Windows 10


By default, you need to dismiss the sign in to Windows 10 with your account.

By default, the Guest account is denied to sign in locally to Windows 10.

See also: Deny log on locally (Windows 10) | Microsoft Docs

This tutorial will show you how to deny specific users and groups from being able to sign in (log on) locally to a Windows 10 PC.

*note You must be signed in as an administrator to deny users and groups to sign in locally.

*Warning Only allowed users and groups will be able to sign in locally to Windows 10. This Deny log on locally policy will override the Allow log on locally policy.

*Warning It is highly recommended to system restore to undo it. For example, if all accounts on the computer are denied to sign in by mistake.


CONTENTS:

• Option One: Deny Users and Groups to Sign in Locally in Local Security Policy
• Option Two: Undeny Users and Groups to Sign in Locally in Local Security Policy
• Option Three: Deny or Undeny Users and Groups to Sign in Locally in Command Prompt

EXAMPLE: "The sign in method you're trying to use isn't allowed. For more info, contact your network administrator." message when a user or group is denied to sign in locally









OPTION ONE [/i] Deny Users and Groups to Sign in Locally in Local Security Policy
*note Local Security Policy is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Three below.
1. Press the Win+R keys to open Run, type secpol.msc into Run, and click/tap on OK to open Local Security Policy.

2. Expand open Local Policies in the left pane of Local Security Policy, click/tap on User Rights Assignment, and double click/tap on the Deny log on locally policy in the right pane. (see screenshot below)



3. Click/tap on the Add User or Group button. (see screenshot below)



4. Click/tap on the Advanced button. (see screenshot below)



5. Click/tap on the Object Types button. (see screenshot below)



6. Check all the boxes for Object types, and click/tap on the OK. (see screenshot below)



7. Click/tap on the Find Now button, select the name of the user or group (ex: "Guests") you want to add to deny, and click/tap on OK. (see screenshots below)

*tip If you like, you can press and hold the Ctrl key to select more than one user and/or group.





8. Click/tap on OK. (see screenshot below)



9. Click/tap on OK. (see screenshot below)



10. When finished, you can close Local Users and Groups if you like.





OPTION TWO [/i] Undeny Users and Groups to Sign in Locally in Local Security Policy
*note Local Security Policy is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Three below.
1. Press the Win+R keys to open Run, type secpol.msc into Run, and click/tap on OK to open Local Security Policy.

2. Expand open Local Policies in the left pane of Local Security Policy, click/tap on User Rights Assignment, and double click/tap on the Deny log on locally policy in the right pane. (see screenshot below)



3. Select the user or group (ex: "Guest") you want to remove to undeny, and click/tap on the Remove button. (see screenshot below)

*tip If you like, you can press and hold the Ctrl key to select more than one user and/or group.



4. Click/tap on OK. (see screenshot below)



5. When finished, you can close Local Users and Groups if you like.





OPTION THREE [/i] Deny or Undeny Users and Groups to Sign in Locally in Command Prompt
1. If you haven't already, you will need to do the following below before continuing on to step 2 below.
A) Download the ntrights.exe file below from the Windows Server 2003 Resource Kit Tools.
Download
B) Save the ntrights.zip file to your desktop, and unblock it.

C) Open the ntrights.zip file, copy or move the ntrights.exe file into your C:\Windows\System32 folder, and click/tap on Continue to approve.
2. Open an elevated command prompt.

3. Type the command you want below into the elevated command prompt, and press Enter.
(Add user or group to allow)
*Arrow ntrights +r SeDenyInteractiveLogonRight -u "User or Group"

OR

(Remove user or group to prevent)
*Arrow ntrights -r SeDenyInteractiveLogonRight -u "User or Group"

*note Substitute User or Group in the command above with the actual name of the user or group (ex: "Guests) you want to add or remove for this policy.

For example: ntrights +r SeDenyInteractiveLogonRight -u "Guests"
4. When finished, you can close the elevated command prompt if you like.

That's it,
Shawn


Related Tutorials

• How to Allow or Prevent Users and Groups to Sign in Locally to Windows 10
• How to Add or Remove Users from Groups in Windows 10
• How to Change User Rights Assignment Security Policy Settings in Windows 10
• How to Enable or Disable User Accounts in Windows 10
• How to Sign in to Windows 10
• How to Enable or Disable Show Local Users on Sign-in Screen on Domain Joined Windows 10 PC
• How to Hide or Show Your Email Address on Sign-in Screen in Windows 10
• How to Do Not Display Last Signed-in User Name on Sign-in Screen in Windows 10
• How to Enable or Disable Don't Display Username at Sign-in in Windows 10
• Enable or Disable Display Last Sign-in Information during User Sign-in in Windows 10
• How to Add a Message at Sign-in for Users in Windows 10
• How to Allow or Prevent Users and Groups to Log on with Remote Desktop in Windows 10
• How to Deny Users and Groups to Log on with Remote Desktop in Windows 10

:)

 

Show Local users and Groups


Hello Frank, and welcome to Ten Forums.

If you have the Windows 10 Home edition, then it will not have Local Users and Groups (lusrmgr.msc) included in it. It's only available in the Pro and Enterprise editions instead.

If you like, you could use step 3 in OPTION THREE of the tutorial below list users in a group.

https://www.tenforums.com/tutorials/6...a.html#option4

 

Show Local users and Groups

Hey Brink, I was just looking at groups in netplwiz today and I noticed that my user account is just in the Admin group now, it used to be in Users and Admin. I have home, so I can't change it. I don't know how it changed. I guess there's nothing I can do about it. Will it be a problem?
I'm tempted to downgrade to my 8.1 pro and go to 10 pro.

 

"The Group Policy Client Service Failed the Sign in" for Windows 10 Local User

I am the admin on our Windows 10 laptop. My son is a local user. I am able to logon as well as my daughter who is also setup as a local user. He receives the "The Group Policy Client Service Failed the sign-in. Access is denied" error upon logging in.

All of the help articles are dated back 9 years at least and don't seem to address this issue.

Microsoft is impossible to get a live person to talk to! Frustrating!!!

 

the group policy client service failed the sign-in access is denied windows 10

Hi you

I have a bad problem. I can't sign in to my account in Windows 10( home )( Asus N501 vw) . There is only one user account and when I type right pass to sign in , a green screen shot appears which contains this sentence:

The group policy client service failed the sign-in access is denied

I have read all suggestion to fix it but I can't sign in and all these suggestions worked when you are​ sign in.

What can I do?

Thanks.best regards

 

Show Local users and Groups


Hello,
I want to get a list of Local Users and Groups as shown in the first screen shot (taken from the Web).
When I run Computer Management as administrator that information is not available under
Computer Management > System Tools (second screen shot - my computer)
How can I get this information?






Thanks