how to restrict access via local logon or remote desktop service for specific user or group

start -> run -> cmd

gpedit.msc

navigate Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings ->

Local Policies -> User Rights Assignment

double click the "Deny log on locally" and add the user or group accordingly

double click the "Deny log on through Remote Desktop Services" and add the user or group accordingly.