Hello, Some applications want to start services with a domain user. I would like certain Windows services start under a domain user on a Windows 2003 or Windows 2008 server but I do not want this user can log into the server. The user should not be a member of domain admins and local admins. The policy "Log on as a service " I have set. What is the best way to achieve this goal? Sincerely, Tiemon

Hi, It seems that you have set the "Log on as a service" policy. Any troubles? If you do not want this user to log into the server, please check the "Allow log on locally" or "Deny logon locally" policy. By default, Administrators, Power Users, Users, Guest and Backup Operators are allowed on workstation and servers. On domain controller, it is set to Account Operators, Administrators, Backup Operators and printer Operators. What is the user right of this domain user? Please help clarify it. For more information, please check the following link: http://technet.microsoft.com/en-us/library/bb457125.aspx Thanks. NinaPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.