Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some users who want to test a Xenapp application using some generic accounts (I don't like to use generic accounts but for reasons I won't go into, they are necessary). I want to setup the accounts such that they can only login to the Xenapp servers and not locally.

A requirement is that the users browse to a specific webpage (Citrix Netscaler) and they login using the generic AD account. At that point the published application is presented to them. I believe the Netscaler authenticates with one of our domain controllers so I'm trying to limit access within AD.

Under the generic account in the Account tab in AD Users and Computers I clicked on Log On To button and added all of the xenapp servers, xenweb servers, and netscaler. However the account us unable to login on the initial webpage (it works fine if I set Log On To = All Computers).

Any insight on what I should configure or where to look would be very helpful. Thanks.

share|improve this question

The thing I understood was you want to authenticate users from AD integrated application but don't want them to login on a computer joined to domain. The option I would like to use for this problem is to restrict login access in Group Policy Editor. You can find this option in:

Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment

Deny log on locally.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.