What other ways can this user log on to a PC or Server?

theoretical question:

if create account in ad with:

deny log on terminal server.

group membership in following: domain admins, domain users, administrators.

and domain gpo prevents log on locally as, , log on service account.

what ways can expect user able authenticate against server?

i have verified smb works fine, rdp denied expected, console login denied expected.

i know i'm missing obvious ones, fill me in..

this forum rights management services. question not answered in forum. 
want encourage post question the 

windows 7 client forums - http://social.technet.microsoft.com/forums/en-us/category/w7itpro
or
windows server forums - http://social.technet.microsoft.com/forums/en-us/category/windowsserver


thank you,
lutz

Windows Server  >  Security