I need to authenticate AD users logging into their workstations only if they belong to the security group AT THE MOMENT OF AUTHENTICATION. They're being added to this privileged group right before they actually put in their passwords (they need to meet certain requirements), then they log on, and after a minute they're being removed from the group.
I thought I could make it with "Log on Locally" GPO - and it almost worked, until the user was removed from the privileged group. This is when he lost access to shared resources.
So my question is - how to affect ONLY authentication process (not the whole interactive session) using security group membership. I care whether he's a member of this privileged group only at the moment of authentication.
Thank you for any suggestions.