Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I ran into an issue when a software that was recommended to me requires to provide it with my admin user account and password not in a UAC prompt (which I do not want to do.)

So I was curious, can I create a Windows user account (belonging to the built-in Administrators group) that interactive users cannot log in to?

share|improve this question
up vote 3 down vote accepted

Yes, and this is sometimes done with "service accounts" in a business environment, to avoid staff using them for normal admin work. You can set the local policy for that user to "Deny Logon Locally". However, you must be running Win7 Pro or better.

Use GPEDIT.MSC; go to Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment: local restrictions

Add the user to the policy, as shown below for "guest":

denied logons

share|improve this answer
Thanks. I didn't know that such GPO can be applied from a local computer. But you're right! Also while at it, you may want to "Deny log on through Remote Desktop Services" for that user as well. Too bad though that the software I needed it for still refuses to run if I enable this restriction :( – MikeF Oct 22 '13 at 8:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.