In an web site, i've developed a function to send email (i.e. connect to exchange). I need to use a special user that in Active Directory has the permission to send mass email. On the other hand, this user shouldn't have the ability to logon to a computer. In Active Directory, what permissions should be changed or revoked?
If you want to deny an Active Directory user the ability to interactively log on to domain computers, either from the console or over Remote Desktop, Group Policy is what you want.
First I would create an Active Directory security group named "Service Accounts" if you don't already have such a group, and I would put your service account in that group.
Next I would go to the Group Policy Management Console, and edit either the Default Domain Policy, or equivalent.
Modify the following policy setting:
Computer Configuration Policies Windows Settings Security Settings Local Policies User Rights Assignment -> Deny log on through Remote Desktop Services -> Deny log on locally
Add your "denied users group" to those GPO settings.
The reason I suggest using an AD group instead of a user is because it's easier to add more service accounts to that security group in the future rather than re-edit the GPO every time.
Secondly, I'm not sure exactly what you mean by "mass email," but I think you mean setting permissions for a distribution list:
If you're just looking to send spam to external recipients across the internet, then just have your C# service use SMTP, and configure your Exchange server to allow SMTP in from the account that's running your service.