Allow user to log into OWA but not into any domain PC?

Question

I am attempting to create an account for an external contractor so that they can have an @domain.com email address and access that from OWA, but not log into any server or PC on the domain.

I've tried setting the Log On To... property to a non-existent PC, and this works in that they can't log into any PCs or servers, but they also can't log into OWA. I'm reluctant to grant them login access to the mail server, as I really want to deny them login access to any PC or server.

I'd also rather not need to use group policy to complete this, as I'd like it to only apply to this one user, and be easy to undo when/if they leave.

Thanks!

Don't fear the Group Policy... It's your friend. – Evan Anderson Feb 05 '13 at 20:37 — Evan Anderson, Feb 05 '13 at 20:37

score 4 · Accepted Answer · answered Feb 05 '13 at 20:36

4

You should be using a Security Group to arbitrate this access, even if the group only ends up with having this one contractor as a member. When you need to redo this in the future for a new contractor you'll be happy you use a group.

Here's what I'd do:

Create a group "Users Denied Interactive Logon", and make the contractor a member.
Create a Group Policy Object (GPO) linked at the root of the domain called "Deny Interactive Logon"
In the "User Rights Assignment" subnode of the "Local Policies" subnode of the "Security Settings" subnode of the "Windows Settings" subnode of the "Computer Configuration" node I would add "Deny log on locally" permission for "Users Denied Interactive Logon" group.

This would be easy to remove if you ever need to, and easy to apply to other users (by way of grouo membership) in the future.

answered Feb 05 '13 at 20:36

Evan Anderson

141,071
19
191
328

Gah, you're quick! – MDMarra Feb 05 '13 at 20:36
That's my job (and I'm an AI-- or so I've heard). – Evan Anderson Feb 05 '13 at 20:37
I see now that you're right, this is probably the best option. Is the default `Authenticated Users` group fine under Security Filtering? – NaOH Feb 05 '13 at 21:03
@NaOH: Yes. You want the GPO to apply to all your computers, so the stock "Security Filtering" setting is fine. – Evan Anderson Feb 05 '13 at 21:23

Allow user to log into OWA but not into any domain PC?

1 Answers1