Deny Access - NT 4.0

The only way you could accomplish something similar would be if instead of giving the administrator group the logon locally right, you give each individual useraccount (ie the other admins) the logon locally right and remove the administator group from the list.
It has to be removed from the group, there is no other way.

regards,

Leopold

Because this is a right that can only be given or not given (as opposed to being able to be specifically rejected), there is no way to do this under NT.

Workarounds are: create a new group that contains all the admins except that one person, and assign the log on locally to the new group.

or

use the "Logon To" option in User Manager to assign which workstations that particular user can log onto.

Hope that helps.

There is no way to remove the Logon locally user right from the administrators group. You can prevent them from logging on locally by using NFTS permissions on the files listed at:
HKEY_LOCAL_MACHINE\HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Userinit

For each of these files (in %SystemRoot%\System32), grant the specific UserName (not a group) No Access. Make sure that at least one Admin Account can logon locally. The easiest way is to run a batch ( Nolocalaccess"Username"):

cacls %SystemRoot%\System32\nddagnt.exe /E /D "%1"
cacls %SystemRoot%\System32\userinit.exe /E /D "%1"
cacls %SystemRoot%\System32\win.com /E /D "%1"
cacls %SystemRoot%\System32\wowexec.exe /E /D "%1"
exit

hope this will help

No way. Since the user belongs to the local administrator group, there's no way to prevent him to log on locally.
You have the chance to make another admin group with all permissions but with the logon locally disable.
You will loose in this casethe ability to be a local administrator of the workstations on the network.

Hope it helps