Allow access to OWA only and deny logon to workstations

I know there's a solution for this out there.

I have a set of email accounts that are used for training purposes. New employees must be able to log into the mailboxes for these users, via OWA, to check the emails, but I don't want them to use the training accoutns to log onto any workstations.

In other words, I need these training accunts to be able to access OWA from any workstation, but be unable to log on to the workstations themselves.
Who is Participating?
uescompConnect With a Mentor Commented:
You might be able to do it by going into the active directory, In AD go into their user properties. On the account tab you'll see a "Log on to" button. Click the button to log onto specific machine but do not put anything in there.
I guess the main question is, how will they be able to access OWA without logging into a workstation, if they are logging into a workstation, which account are they using in order to get to OWA.

In any case the question is a little confusing.  Overall what do you not want them to use or access when they log onto a workstation.
Shreedhar EtteCommented:

Refer this:

and restrict the user to logon to a desktop, then set time windows of do not logon there.

I hope this helps,
RGEIS2000Author Commented:
I don't see the confusinon. Users that can access OWA, but can not log onto Windows. They'd have to access OWA on a workstation that's already logged on.
All Courses

From novice to tech pro — start learning today.