How to create user that can run stuff, but can't log on

[phillydog]

I need to create an account on WIN/2003 (I'm sure it is the same on WIN/NT and 2K) for which a user can run items when prompted for credentials via a website, but cannot log onto the box itself.

On Linux, I did this by creating a user 'dummy' and giving 400 permissions to /home/dummy

Since the temp files can't be read and the main files can't be executed, the user gets an error message informing them to talk to the admin.

My company software requires that when running a report, credentials must be populated (dummy/dummy), and this must be a valid user on the box....

I am trying to lock down my box, and am trying to avoid applying NTFS permissions to all directories on the drive, and trying to find a simple way to apply this limitation on the user instead.

The user is not part of any group currently... was thinking of adding to the 'POP3 Users' since no mail server is being run.

Any help is appreciated.

 

[drag]

You'd probably have to setup a group or user policy to do that. Not sure of the specifics though.

 

[tyanni]

You can edit the local security policy to prevent local logins on these machines. Go to secpol.msc /s and edit the deny local login policy. Add this user to the machine. If he or she tries to login, they will be prompted that a local security policy prevents interactive logins.

 

[phillydog]

Editing the local policies to DENY the user worked... I had removed the user previously from the groups in ALLOW local login but didn't work..

Thanks again...