Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For a Windows 2008 Server running in a Workgroup envrionment (no Active Directory), is it possible to create users for the purpose of authentication in a web service application that DO NOT have a GUI login as well?

Users created using Local Users and Groups can be used for authentication, but they automatically get permission to log on to the server and have a desktop as well.

I would like to create accounts which can only be used for authentication in an IIS hosted web service application. The application uses Windows Authentication to grant access.

The users will be connecting from other desktop machines with a web browser.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

You should be able to control this via the NTRights tool http://support.microsoft.com/kb/315276

You are looking to 'deny interactive login' and/or "log on locally", since it is not on a domain. (If you were doing this in a domain, you'd look for similar under GPO.)

It should also be possible in the Local Security Policy (In 2008, "Security Configuration Management" under Administrative Tools.)

share|improve this answer
1  
This works. Administrative Tools, Local Security Policy, Security Settings, Local Policies, User Rights Assignment, Deny log on locally. This setting allows you to enter the user id's which are not allowed to log on locally. So, after creating the user accounts, add them to this list. Thank you very much gWaldo. –  Chris C. Aug 8 '12 at 15:29
    
You are quite welcome! –  gWaldo Aug 8 '12 at 16:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.