2

Normally we create service accounts in Active Directory, and if we install things like SQL Server, etc, we set services to use those service accounts. The service accounts don't have the ability to be used to log into a workstation interactively.

For Proof of concept, we're installing SQL Server and other software on Virtual windows 7 workstations that aren't part of a domain, so we are creating local accounts that will be used by windows services. Is it possible to stop those users from appearing as options on the login screen?

2 Answers 2

8

Another option would be to use virtual accounts. New to Windows 7 and Windows Server 2008 R2, services can run as a virtual service account that doesn't exist as a user on the machine and cannot be used interactively.

To run a service using a virtual account, the logon user should be set to "NT SERVICE\{servicename}" (the password can be left blank). For example, SQL Server Express' virtual account might be called "NT SERVICE\MSSQL$SQLEXPRESS"

This would give two benefits:

  1. Eliminate the need to manage passwords for the service accounts (virtual accounts can only be used by Windows Services; they cannot be used to gain remote access to the computer or log on interactively).
  2. The users will not appear on the logon screen.

If a service accesses the network while running as a virtual account, it accesses resources as the computer account (DOMAIN\Computername$). But, since these computers aren't joined to a domain, this shouldn't be an issue anyway.

I learned of virtual accounts from this blog post that gives a quick overview of virtual accounts (and managed service accounts).

1

Yes.

If you want to hide users, try this approach:

To hide additional user accounts on Windows & Logon Use Regedit, also works for Vista

Hide User Accounts in windows Vista and Windows 7

At Run, type regedit

Once in regedit go to HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon

In the left panel, right click on Winlogon and click New and click Key.

Type SpecialAccounts and press Enter

In the left panel, right click on SpecialAccounts and click New and click Key.

Type UserList and press Enter.

In right panel of UserList, right click on a empty area and click New then click DWORD (32bit) Value.

Type in the name of the user account that you want to hide and press Enter.eg: Everyday Account.

In the right panel, right click on the user account name and click Modify.

To hide the user account – Type 0 and click OK. (number zero not the letter)

Whenever you want to use the account just unhide the it by typing 1 instead of zero.

This process is described in more detail here.

As an alternative, you can hide the entire Welcome Screen and force everyone to enter their Username and Password as described here. The registry value should be set to 1.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .