Custom allow/deny Windows users

With the advanced setting authentication mode set as windows, I’d like to use my own logic to have the option to deny the login for a user logging by that way (any way, actually).
I’ve tried returning false in User_LoggingIn, but it only works for regular users; it seems that windows user logon does not use that function.
How can I return false to deny the login to windows users?

You cannot deny login to Windows user because they are already authenticated when they go to the site. (The ‘AUTH_USER’ can be found in server variables.) However, you can use CheckPassportEvent to check the user and throw an exception if the user is not allowed,

That was easy! Brilliant, thanks!