By the default, Administrators, Backup Operators,
Power Users, Users, and Guest are assigned rights to log on locally on
workstations and servers; Account Operators, Administrators, Backup Operators,
and Print Operators are assigned rights to log on locally on domain
controllers. To prevent some users to access a computer, go to MMC>Local
Computer Policy>Computer Configuration>Windows Settings>Security
Settings>Local Policies>User Rights Assignment, remove the Users and add a
user or groups who are allowed to access to the computer.
