title: Deny Logon Locally without affecting "Run As"
body: <p>I am trying to implement a technical control in our environment so that certain AD accounts are restricted from logging onto a workstation locally, but the account should be allowed to use the "Run As" function. I thought about implementing the "Deny Logon Locally" GPO thought User rights assignment, but the problem is that these are privilege accounts that users need to elevate permissions to carry out admin functions.</p>
  
  <p>So the Deny Logon Locally GPO would also prevent the account from elevating using the "Run As" function. So how can I stop an account from physically logging onto Windows, but the account should be able to use the "Run As"?</p>
  
  <p>Deny Logon Locally GPO</p>
  
  <p>GPO</p>
  
  <p>"Run As" is also being affected.</p>