@Giovanni-Baldi,
Windows uses group policy to control interactive logon AND the use of "run as." So the policy will not provide you a direct way to restrict one but not the other.
A work around may be where you can force the interactive logon to logoff immediately instead of logging on instead. You can do this with the following:
-
Create an OU to group your restricted logon accounts. Move the user accounts into this OU.
-
Create a GPO and apply to the OU
-
Edit the GPO: User Configuration > Policies > Administrative Template > System
a. set Custom User Interafce
to logoff.exe
-
You will need to run either gpupdate
to apply the settings to on the computers you intend to test if you need to verify it quickly.
Cordially,
Ronnie Wong
Edutainer Manager, ITProTV
*if the post above has answered the question, please mark as solved.
**All "answers" and responses are offered "as is" and my opinion. There is no implied service, support, or guarantee by ITProTV.