2

For a Windows 2008 Server running in a Workgroup envrionment (no Active Directory), is it possible to create users for the purpose of authentication in a web service application that DO NOT have a GUI login as well?

Users created using Local Users and Groups can be used for authentication, but they automatically get permission to log on to the server and have a desktop as well.

I would like to create accounts which can only be used for authentication in an IIS hosted web service application. The application uses Windows Authentication to grant access.

The users will be connecting from other desktop machines with a web browser.

Improve this question

1 Answer 1

Reset to default
1

You should be able to control this via the NTRights tool http://support.microsoft.com/kb/315276

You are looking to 'deny interactive login' and/or "log on locally", since it is not on a domain. (If you were doing this in a domain, you'd look for similar under GPO.)

It should also be possible in the Local Security Policy (In 2008, "Security Configuration Management" under Administrative Tools.)

Improve this answer
2
  • 1
    This works. Administrative Tools, Local Security Policy, Security Settings, Local Policies, User Rights Assignment, Deny log on locally. This setting allows you to enter the user id's which are not allowed to log on locally. So, after creating the user accounts, add them to this list. Thank you very much gWaldo.
    – Chris C.
    Aug 8, 2012 at 15:29
  • You are quite welcome!
    – gWaldo
    Aug 8, 2012 at 16:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .