I ran into an issue when a software that was recommended to me requires to provide it with my admin user account and password not in a UAC prompt (which I do not want to do.)

So I was curious, can I create a Windows user account (belonging to the built-in Administrators group) that interactive users cannot log in to?


Yes, and this is sometimes done with "service accounts" in a business environment, to avoid staff using them for normal admin work. You can set the local policy for that user to "Deny Logon Locally". However, you must be running Win7 Pro or better.

Use GPEDIT.MSC; go to Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment: local restrictions

Add the user to the policy, as shown below for "guest":

denied logons

  • Thanks. I didn't know that such GPO can be applied from a local computer. But you're right! Also while at it, you may want to "Deny log on through Remote Desktop Services" for that user as well. Too bad though that the software I needed it for still refuses to run if I enable this restriction :( – MikeF Oct 22 '13 at 8:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.