How to restrict user log ins to only a specific set of computers

Create a group to encapsulate the users (Local-Admins-Tablets) and add them to this group

Create a sub-OU of the current workstations OU and put the tablets in here (Workstations\Tablets)

Create a GPO (Local-Admins-Tablets-Policy) and link it to the Workstations\Tablets OU

In the GPO, set the following:

• Comp Config - Policies - Windows Settings - Security Settings - Restricted Groups
• Right click, Add Group
• "Administrators", OK
• Members of this Group: myDomain\Local-Admins-Tablets

Reboot the PCs, and done.

Bear in mind that setting Restricted Groups will overwrite the machines existing list of local Administrators. If you have other users/groups in there already, you will need to add them to this policy too. Other examples would be myDomain\Domain Admins etc

EDIT: Oh, and change the filtering on the GPO and add Domain Computers. The easiest way to do this is to use the Group Policy Management MMC snapin (you can get this from the Remote Server Administration Tools from Microsoft)

Use an OU - there is no such thing as a network too small to use an OU. Apply the policies to the OU as you can't apply Group Policies to the default users and computers container.

If you want to use this setup, I would create a "Computer" OU, move all the regular computer accounts to that OU and apply the default comptuer OU there. Create a child OU "MgmtComputers" OU off the Computer OU and apply just the Management computer OU there.

Edit: BTW - if you are setting "domain users" as local administrators in your default computer policy and allowing "Log On Locally" to include the administrator group, since every domain user is a local admin, it would still allow every user to login to every computer.