ctrl-alt-del at login

http://support.microsoft.com/support/kb/articles/Q234/5/62.ASP that is the walkthrough for what you are wanting to do. cheers.

Thanks, but I wasn't clear in my question. I was wondering if this could be done by way of a GPO applied to all computers in a domain (as opposed to setting that option on each computer on the network).

Sure it can be done. All you need to do is define these settings in your group policy. If you make the changes to the policy at the domain level it will take effect for your entire domain. You will find these settings here AD USERS AND COMPUTERS > (choose your domain and right click .. properties) > GROUP POLICY TAB in there you will see your domain policy.. highlight it and click edit Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options Under security options you will see a list of variables you can define... just choose the ones you want and enable them. If I were you I would also disable cached logons. To do this you set the value to 0. Also, give it up to 90 minutes to replicate throughout the domain. Cheers, Michael Ward, MCSE, CCNA