Hey all, I am wondering if I can delete the two user listings in the User Properties dialog. As you know, they are: NT AUTHORITY/Authenticated Users (S-1-5-11) NT AUTHORITY/INTERACTIVE (S-1-5-4). these are to be used for six machines in a little student lab and all students will be logging in with their own domain accounts. Thanks! Chuck

NO! don't delete those user listings. A much better way to accomplish what you want is to use Group Policy. I would recommend you to create multiple Active Directory Group Policies, filter them using the computer object/OU/security group with computer objects etc. it should apply to, so that the GPO is applied only to the computers you want it to apply to. In the GPO you then use "User Rights Assignment" and the "Allow logon locally" option. User rights assignment you find under Computer Configuration - Windows Settings - Security Settings - Local Policies. This way you don't have to mess around with the local groups and you don't need to use a VB script, and you can at any time reverse or change the settings centrally by using Active Directory Group Policies.... If you don't have Active Directory you'll need to do all the changes locally - of course if you don't have Active Directory I would really recommend you to upgrade if possible. When changing the log on locally user right I would also add Domain Admins.