Does that work on domain users too or only if you try to logon locally?
It works on domain users if your computer is part of a domain.

You can push the "deny login locally" policies by GPO also but do you really want to push the same GPO to all 40 computers? Basically, only one users will being able to log to this 40 computers?

Another solution that you could test if the "allow logon locally" policies overwrite the "deny logon locally". I'm not sure witch one win. I think the deny will win but you should give it a try.

P.S. Don't remove the NTFS permission, Windows is very touchy about that is NTFS permission!