Prohibit NTLM machine login

Hi,

can anybody tell me how to prohibit the login of windows machine accounts?

My problem is the following:

For some reason, some users login into XG via NTLM with there user-account and machine-account too.

But the machine-account has no right to access the WAN, an error message is displayed and the user is unable to access the internet.

In my understanding every individual that tries to login is checked against the avaiable authentication servers and if there is a match but no group inside the XG, the user is mapped into the "Open Group". In my case, the computer/machine-accounts are going here.

The used LDAP-authentication is pointed to the root tree of AD structure, not to a specific folder. 

EDIT:

As I found this KB atricle, it descibes my problem, but the part with "Once the user logs in, the Machine Name is replaced by the username." is wrong, it doenst't happen.