user-signin-ad

 1) Open the Group Policy editor using gpmc.msc

2) Select your domain and expand Group Policy Objects then right click on "Default Domain Controller Policy"    and Click Edit
3) Under Computer Management, expand Policies and then select Windows Settings
4) Expand Security Settings and Select Local Policies and then click on User Rights Management
5) Right click on Deny log on locally and click on Properties
6) In the next screen you can remove the User of Group that you want