limit local users

Hi

I have setup a server with a domain controler. There are also some 20 workstations connected to it.
Recently I descovered that some users login localy to the computers and bypass login in to the DNS. This cause me lot of hassle by finding out that they have installed unauthorised softwares.
How can I restrict them of not being able to login locally. I do know that its in computer configuration of GPO, but somehow it doesn’t seems to be working !!!!!

Could someone step by step tell me how it works.

Thanks