Deny AD-User Group to login on a certain AD-Computer Group

Settings that are defined in domain GPOs override settings on the local machine. Settings that are undefined in the domain GPO will remain with the settings in the local policy.

A great way to test is to use Resultant Set of Policy. It will tell you where and through what means settings are applied.

http://technet.microsoft.com/en-us/library/cc758010%28WS.10%29.aspx

It's possible, yes.

Not really advisable, because the supported and recommended way to do this is through the gpedit.msc tool (or GPOs on a domain). As a result, doing it with a script is semi-documented at best, and you do run into some oddities trying.

If you're still determined to try, theses settings are really just registry keys. If can figure out which keys are changed, it's trivial to script something up to import all those registry keys and end up with the desired configuration. I'd just use a batch file, honestly.

The problem you'll run into, however, is that these changes need to be saved to %SYSTEM ROOT%\System32\GroupPolicy\User\Registry.pol to be enforced as local group policy, and I don't know of a good scripted solution to that, so the common workaround is to set this up the way you want on a second machine, and copy the %SYSTEM ROOT%\System32\GroupPolicy\User folder and files to your target machines.

I personally find the whole thing to be such a pain that I'd rather set up a small domain than go through that process to apply automate applying local group policy.