Windows uses group policy to control interactive logon AND the use of "run as." So the policy will not provide you a direct way to restrict one but not the other.
A work around may be where you can force the interactive logon to logoff immediately instead of logging on instead. You can do this with the following:
Create an OU to group your restricted logon accounts. Move the user accounts into this OU.
Create a GPO and apply to the OU
Edit the GPO:
User Configuration > Policies > Administrative Template > System
Custom User Interafce to
You will need to run either
gpupdate to apply the settings to on the computers you intend to test if you need to verify it quickly.
Edutainer Manager, ITProTV
*if the post above has answered the question, please mark as solved.
**All "answers" and responses are offered "as is" and my opinion. There is no implied service, support, or guarantee by ITProTV.