Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For a Windows 2008 Server running in a Workgroup envrionment (no Active Directory), is it possible to create users for the purpose of authentication in a web service application that DO NOT have a GUI login as well?

Users created using Local Users and Groups can be used for authentication, but they automatically get permission to log on to the server and have a desktop as well.

I would like to create accounts which can only be used for authentication in an IIS hosted web service application. The application uses Windows Authentication to grant access.

The users will be connecting from other desktop machines with a web browser.

share|improve this question
up vote 1 down vote accepted

You should be able to control this via the NTRights tool

You are looking to 'deny interactive login' and/or "log on locally", since it is not on a domain. (If you were doing this in a domain, you'd look for similar under GPO.)

It should also be possible in the Local Security Policy (In 2008, "Security Configuration Management" under Administrative Tools.)

share|improve this answer
This works. Administrative Tools, Local Security Policy, Security Settings, Local Policies, User Rights Assignment, Deny log on locally. This setting allows you to enter the user id's which are not allowed to log on locally. So, after creating the user accounts, add them to this list. Thank you very much gWaldo. – Chris C. Aug 8 '12 at 15:29
You are quite welcome! – gWaldo Aug 8 '12 at 16:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.