I recently moved into a new position and we have a few computer labs that are currently restricting access by running a script on logon that checks the user's group membership and if not in the correct group, displays an error message telling them who to contact if they think they need access, and the logs them off. My two issues with this are that it does not display the error for too long so someone might not be able to read it, and the script can be killed which keeps them logged in.
I'd like to move this restriction to group policy by enabling the 'Allow log on locally' policy and adding the proper groups. I'd still like to be able to display our custom error message though and was wondering if there was a way to change the error that appears when a logon is denied because of this policy. I know one way would be to just change the text on the logon screen but I want to keep that area relatively clean (we have some text there already and don't want to put a book there). Any ideas are greatly appreciated.
