I am attempting to create an account for an external contractor so that they can have an @domain.com email address and access that from OWA, but not log into any server or PC on the domain.

I've tried setting the Log On To... property to a non-existent PC, and this works in that they can't log into any PCs or servers, but they also can't log into OWA. I'm reluctant to grant them login access to the mail server, as I really want to deny them login access to any PC or server.

I'd also rather not need to use group policy to complete this, as I'd like it to only apply to this one user, and be easy to undo when/if they leave.


  • Don't fear the Group Policy... It's your friend. Commented Feb 5, 2013 at 20:37

1 Answer 1


You should be using a Security Group to arbitrate this access, even if the group only ends up with having this one contractor as a member. When you need to redo this in the future for a new contractor you'll be happy you use a group.

Here's what I'd do:

  • Create a group "Users Denied Interactive Logon", and make the contractor a member.
  • Create a Group Policy Object (GPO) linked at the root of the domain called "Deny Interactive Logon"
  • In the "User Rights Assignment" subnode of the "Local Policies" subnode of the "Security Settings" subnode of the "Windows Settings" subnode of the "Computer Configuration" node I would add "Deny log on locally" permission for "Users Denied Interactive Logon" group.

This would be easy to remove if you ever need to, and easy to apply to other users (by way of grouo membership) in the future.

  • Gah, you're quick!
    – MDMarra
    Commented Feb 5, 2013 at 20:36
  • That's my job (and I'm an AI-- or so I've heard). Commented Feb 5, 2013 at 20:37
  • I see now that you're right, this is probably the best option. Is the default Authenticated Users group fine under Security Filtering?
    – NaOH
    Commented Feb 5, 2013 at 21:03
  • @NaOH: Yes. You want the GPO to apply to all your computers, so the stock "Security Filtering" setting is fine. Commented Feb 5, 2013 at 21:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .