Deny logon as a batch job
Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
Determines which accounts are prevented from being able to log on as a batch job. This policy setting supercedes the Log on as a batch job policy setting if a user account is subject to both policies.
This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.
By default, there are no users denied logon as a batch job.