How to Deny Local Sign-In for Users and Groups in Windows 10 Restricting local sign-ins is a powerful way to keep unauthorized users out, and your infrastructure protected. In this video, we'll walk you through exactly how to deny local sign-in access for specific users and groups. Before we begin, be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this. How to deny users or groups from signing in locally Before you start, back up your files or system image— just in case you need to restore anything later. When it comes to blocking local user logins on Windows 10, you've got two main tools: Group Policy and Local Security Policy. Option 1: Using Local Security Policy (recommended) Note that Local Security Policy is only available on Windows 10 Pro, Enterprise, or Education editions. Here's how to deny local login: Press Win + R, type secpol.msc, and hit OK. Go to Local Policies > User Rights Assignment. Double-click Deny log on locally. Click Add user or group, then Advanced. Select Object types, check all boxes, and press OK. Click Find Now, choose the user or group to restrict. Hit Apply, then OK to save changes. Option 2: Group Policy Another option is to use Group Policy. Here's how: Press Win + R, type gpedit.msc, and hit Enter. Go to: Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment Double-click Deny log on locally. Click Add User or Group, then enter the usernames or groups to block. To apply changes, either restart the system or run gpupdate /force in Command Prompt. Troubleshooting local user login in Windows 10 policy You might run into some common problems while denying local sign-in. Here are some fixes issue. User is still able to sign in after the restriction. Users who were already signed in before the restrictions were set will need to log out and restart their devices for the changes to work. If you're applying this for the first time, it's best to do it during off hours. Issue: Accidentally locked out all users. Starting in Safe Mode might bypass some restrictions. If there's another active Administrator account, you can try fixing the issue from there. Local Sign-in Policy FAQs Here are some frequently asked questions about Local Sign-in Policy. What happens if I accidentally restrict all users, including administrators? If you accidentally block all accounts, including admins, you could get locked out of the system. Try rebooting in Safe Mode. If that doesn’t work, you may need to reset your computer to fix it. Can I deny local sign-in but still allow remote access? Yes, local sign-in restrictions don’t affect remote desktop access. To control that, you’ll need to use the “Allow log on through Remote Desktop Services” policy. User Rights Assignment policies are a helpful way to manage who can access your device or network. If you're planning to adjust these settings, it's best to use Group Policy or the Local Security Policy console to limit the risk of misconfiguration. For more information, check out our official blog post on how to deny local sign-in, linked in the description below. Oh.