Log on as a Service for multiple accounts & machines

[barckleyt]

We manage the Log on as a Service right via GPO at our organization. We're running into a bit of a problem because one account on one server needs log on as a service rights, and another account on a different server needs log on as a service rights, etc., etc. We could add all of the accounts to one GPO that applies to all servers, but that grants many of the accounts more rights than they need (i.e. they could run as a service on all servers instead of just the one they need to). Security folks have a problem with this approach. The alternative seems to be to create one policy for each server, but this creates a ton of policies, and if we have accounts that need the run as a service right on all servers, then we have to touch every single one of these server-specific policies (since this setting overwrites the previous value instead of appending).

Is there a better way to do this?

[barckleyt]

Bump. Anybody have any suggestions for a better way to manage the Log on as a Service right?