Is it possible to restrict the account with UID 0 so that it can join the domain but cannot be used for an interactive logon/session ? (I'm wanting something like the "Unable to log you on because of an account restriction" message.) If so, how ? Regards, Patrick