based on GPO pointed by SDK, I suggest you that instead going on that way (deny others)
just change this http://msdn.microsoft.com/library/de...-us/gp/547.asp
by Default, everybody is on that policy. Just add admins and that user and remove everybody else.