Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am attempting to create an account for an external contractor so that they can have an @domain.com email address and access that from OWA, but not log into any server or PC on the domain.

I've tried setting the Log On To... property to a non-existent PC, and this works in that they can't log into any PCs or servers, but they also can't log into OWA. I'm reluctant to grant them login access to the mail server, as I really want to deny them login access to any PC or server.

I'd also rather not need to use group policy to complete this, as I'd like it to only apply to this one user, and be easy to undo when/if they leave.

Thanks!

share|improve this question
    
Don't fear the Group Policy... It's your friend. –  Evan Anderson Feb 5 '13 at 20:37
add comment

1 Answer

up vote 4 down vote accepted

You should be using a Security Group to arbitrate this access, even if the group only ends up with having this one contractor as a member. When you need to redo this in the future for a new contractor you'll be happy you use a group.

Here's what I'd do:

  • Create a group "Users Denied Interactive Logon", and make the contractor a member.
  • Create a Group Policy Object (GPO) linked at the root of the domain called "Deny Interactive Logon"
  • In the "User Rights Assignment" subnode of the "Local Policies" subnode of the "Security Settings" subnode of the "Windows Settings" subnode of the "Computer Configuration" node I would add "Deny log on locally" permission for "Users Denied Interactive Logon" group.

This would be easy to remove if you ever need to, and easy to apply to other users (by way of grouo membership) in the future.

share|improve this answer
    
Gah, you're quick! –  MDMarra Feb 5 '13 at 20:36
    
That's my job (and I'm an AI-- or so I've heard). –  Evan Anderson Feb 5 '13 at 20:37
    
I see now that you're right, this is probably the best option. Is the default Authenticated Users group fine under Security Filtering? –  NaOH Feb 5 '13 at 21:03
    
@NaOH: Yes. You want the GPO to apply to all your computers, so the stock "Security Filtering" setting is fine. –  Evan Anderson Feb 5 '13 at 21:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.