How to Deny Users and Groups to Sign in Locally to Windows 10


By default, you need to dismiss the lock screen and enter your credentials to sign in to Windows 10 with your account.

By default, the Guest account is denied to sign in locally to Windows 10.

See also: Deny log on locally (Windows 10) | Microsoft Docs

This tutorial will show you how to deny specific users and groups from being able to sign in (log on) locally to a Windows 10 PC.

You must be signed in as an administrator to deny users and groups to sign in locally.

Only allowed users and groups will be able to sign in locally to Windows 10. This Deny log on locally policy will override the Allow log on locally policy.

It is highly recommended to create a restore point before you "deny log on locally" for users and groups in case you may need to do a system restore to undo it. For example, if all accounts on the computer are denied to sign in by mistake.


 CONTENTS:

  • Option One: Deny Users and Groups to Sign in Locally in Local Security Policy
  • Option Two: Undeny Users and Groups to Sign in Locally in Local Security Policy
  • Option Three: Deny or Undeny Users and Groups to Sign in Locally in Command Prompt


EXAMPLE: "The sign in method you're trying to use isn't allowed. For more info, contact your network administrator." message when a user or group is denied to sign in locally
Name:  Not_allowed_to_sign-in_to_Windows_10.jpg
Views: 450
Size:  46.5 KB






Deny Users and Groups to Sign in Locally to Windows 10 OPTION ONE Deny Users and Groups to Sign in Locally to Windows 10
Deny Users and Groups to Sign in Locally in Local Security Policy

Local Security Policy is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Three below.

1. Press the Win+R keys to open Run, type secpol.msc into Run, and click/tap on OK to open Local Security Policy.

2. Expand open Local Policies in the left pane of Local Security Policy, click/tap on User Rights Assignment, and double click/tap on the Deny log on locally policy in the right pane. (see screenshot below)

Name:  Deny_Log_on_locally_user_rights_assignment-1.jpg
Views: 445
Size:  71.5 KB

3. Click/tap on the Add User or Group button. (see screenshot below)

Name:  Deny_Log_on_locally_user_rights_assignment-4.png
Views: 445
Size:  9.3 KB

4. Click/tap on the Advanced button. (see screenshot below)

Name:  Deny_Log_on_locally_user_rights_assignment-5.png
Views: 430
Size:  8.7 KB

5. Click/tap on the Object Types button. (see screenshot below)

Name:  Deny_Log_on_locally_user_rights_assignment-6.png
Views: 437
Size:  14.6 KB

6. Check all the boxes for Object types, and click/tap on the OK. (see screenshot below)

Name:  Deny_Log_on_locally_user_rights_assignment-7.png
Views: 431
Size:  9.4 KB

7. Click/tap on the Find Now button, select the name of the user or group (ex: "Guests") you want to add to deny, and click/tap on OK. (see screenshots below)

If you like, you can press and hold the Ctrl key to select more than one user and/or group.

Name:  Deny_Log_on_locally_user_rights_assignment-8.jpg
Views: 431
Size:  62.6 KB Name:  Deny_Log_on_locally_user_rights_assignment-9.jpg
Views: 438
Size:  55.7 KB

8. Click/tap on OK. (see screenshot below)

Name:  Deny_Log_on_locally_user_rights_assignment-10.png
Views: 432
Size:  9.3 KB

9. Click/tap on OK. (see screenshot below)

Name:  Deny_Log_on_locally_user_rights_assignment-11.png
Views: 445
Size:  9.0 KB

10. When finished, you can close Local Users and Groups if you like.






Deny Users and Groups to Sign in Locally to Windows 10 OPTION TWO Deny Users and Groups to Sign in Locally to Windows 10
Undeny Users and Groups to Sign in Locally in Local Security Policy

Local Security Policy is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Three below.

1. Press the Win+R keys to open Run, type secpol.msc into Run, and click/tap on OK to open Local Security Policy.

2. Expand open Local Policies in the left pane of Local Security Policy, click/tap on User Rights Assignment, and double click/tap on the Deny log on locally policy in the right pane. (see screenshot below)

Name:  Deny_Log_on_locally_user_rights_assignment-1.jpg
Views: 445
Size:  71.5 KB

3. Select the user or group (ex: "Guest") you want to remove to undeny, and click/tap on the Remove button. (see screenshot below)

If you like, you can press and hold the Ctrl key to select more than one user and/or group.

Name:  Deny_Log_on_locally_user_rights_assignment-2.png
Views: 441
Size:  10.4 KB

4. Click/tap on OK. (see screenshot below)

Name:  Deny_Log_on_locally_user_rights_assignment-3.png
Views: 436
Size:  9.3 KB

5. When finished, you can close Local Users and Groups if you like.






Deny Users and Groups to Sign in Locally to Windows 10 OPTION THREE Deny Users and Groups to Sign in Locally to Windows 10
Deny or Undeny Users and Groups to Sign in Locally in Command Prompt

1. If you haven't already, you will need to do the following below before continuing on to step 2 below.

A) Download the ntrights.exe file below from the Windows Server 2003 Resource Kit Tools.

download

B) Save the ntrights.zip file to your desktop, and unblock it.

C) Open the ntrights.zip file, copy or move the ntrights.exe file into your C:\Windows\System32 folder, and click/tap on Continue to approve.

2. Open an elevated command prompt.

3. Type the command you want below into the elevated command prompt, and press Enter.

(Add user or group to allow)
ntrights +r SeDenyInteractiveLogonRight -u "User or Group"

OR

(Remove user or group to prevent)
ntrights -r SeDenyInteractiveLogonRight -u "User or Group"

Substitute User or Group in the command above with the actual name of the user or group (ex: "Guests) you want to add or remove for this policy.

For example: ntrights +r SeDenyInteractiveLogonRight -u "Guests"

4. When finished, you can close the elevated command prompt if you like.


That's it,
Shawn


Related Tutorials