How do i create a user who only has access to exchange email?

Question

We have 2 new external contractors who are contacting customers on our behalf and we want them to be able to send mails only. They have outlook and we have outlook web access configured. However, I don't want their user accounts to be able to log onto any of our internal computers/servers.

Whats the easiest way to configure this ?

Solution 1

You should also be able to set their associated AD account's "Log On To..." setting (on the "Account" tab) to a non-existent PC name (one that you would never use) like "NOPCACCESS".

That will restrict them to only being able to log on to a PC with that name, so since it doesn't exist, they can't log on to any PC. However, they should still be able to access email. I tested this with Exchange 2010 and it allowed both Outlook and OWA access, while restricting logging into a PC.

If you do use the setup, I would still test to ensure it acts as you want it to.

Solution 2

Create a security group, use a GPO to deny members logon rights (or just locla log on rights, depending on what, precisely, you mean here) to domain computers by default, add the two contractor's accounts to it, and then make sure that doesn't adversely impact OWA or Exchange access. I've done that in the past (and maybe at my current job?) to create mail-only users.

Comments

[resolver101]

changed the log on to "NOPCACCESS" on the user account properties page and user can no longer logon locally but can access his emails. I thought this solution was simpler than the others. I also removed remote web access group membership from the user.