Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have 2 new external contractors who are contacting customers on our behalf and we want them to be able to send mails only. They have outlook and we have outlook web access configured. However, I don't want their user accounts to be able to log onto any of our internal computers/servers.

Whats the easiest way to configure this ?

share|improve this question
add comment

2 Answers 2

up vote 0 down vote accepted

You should also be able to set their associated AD account's "Log On To..." setting (on the "Account" tab) to a non-existent PC name (one that you would never use) like "NOPCACCESS".

That will restrict them to only being able to log on to a PC with that name, so since it doesn't exist, they can't log on to any PC. However, they should still be able to access email. I tested this with Exchange 2010 and it allowed both Outlook and OWA access, while restricting logging into a PC.

If you do use the setup, I would still test to ensure it acts as you want it to.

share|improve this answer
    
changed the log on to "NOPCACCESS" on the user account properties page and user can no longer logon locally but can access his emails. I thought this solution was simpler than the others. I also removed remote web access group membership from the user. –  resolver101 Feb 12 '13 at 17:12
add comment

Create a security group, use a GPO to deny members logon rights (or just locla log on rights, depending on what, precisely, you mean here) to domain computers by default, add the two contractor's accounts to it, and then make sure that doesn't adversely impact OWA or Exchange access. I've done that in the past (and maybe at my current job?) to create mail-only users.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.