In an web site, i've developed a function to send email (i.e. connect to exchange). I need to use a special user that in Active Directory has the permission to send mass email. On the other hand, this user shouldn't have the ability to logon to a computer. In Active Directory, what permissions should be changed or revoked?


If you want to deny an Active Directory user the ability to interactively log on to domain computers, either from the console or over Remote Desktop, Group Policy is what you want.

First I would create an Active Directory security group named "Service Accounts" if you don't already have such a group, and I would put your service account in that group.

Next I would go to the Group Policy Management Console, and edit either the Default Domain Policy, or equivalent.

Modify the following policy setting:

Computer Configuration
  Windows Settings
   Security Settings
    Local Policies
     User Rights Assignment
       -> Deny log on through Remote Desktop Services
       -> Deny log on locally

Add your "denied users group" to those GPO settings.

Deny log on

The reason I suggest using an AD group instead of a user is because it's easier to add more service accounts to that security group in the future rather than re-edit the GPO every time.

Secondly, I'm not sure exactly what you mean by "mass email," but I think you mean setting permissions for a distribution list:


If you're just looking to send spam to external recipients across the internet, then just have your C# service use SMTP, and configure your Exchange server to allow SMTP in from the account that's running your service.

enter image description here

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.