Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running Windows Server 2008 R2 in a workgroup, not a domain, and I want to create a local account that is only used for allowing other computers in the same workgroup to access file shares on that server.

When clients connect they will be prompted for a username/password (hopefully) and this account would serve as a way to allow them access.

I do not want this account to have a profile, or be used to actually log into the server itself. I only need it as a way to authenticate users for shared folders.

Can this be done? If not, what is the recommended approach for this?

share|improve this question
up vote 7 down vote accepted

Sure it can be done. When you've set up the local user account on the server add the user account to the "Deny log on locally" and "Deny log on through Terminal Services" user rights assignment. That will prevent anyone from using this user account to log on to the server locally or via TS/RDS but will allow them to access the share with this uer.

share|improve this answer
How do I do this? – void.pointer Oct 20 '11 at 17:36
Umm... 1. Create the user. 2. Add the user to the user rights assignments I listed above. 3. Create share and set apporpriate Share and NTFS permissions. 4. Access share from workstation. 6. Done. – joeqwerty Oct 20 '11 at 17:39
What I mean is, how do I do user rights assignments? Is this done in Computer Management? – void.pointer Oct 20 '11 at 18:48
It's done in the Local Security Policy mmc, which is in Administrative Tools. – joeqwerty Oct 20 '11 at 19:15

You should be able to accomplish this by creating the local account, giving it share and NTFS rights on the file shares. Then use secedit to edit the local security policy. You want to use Local Policies> User Rights Assignment> Deny log on locally. Add the account to this setting.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.