Lock out account, but don't disable.

[mkools]

Hi,

When we disable accounts with AD, the disabled user can't recieve mail any longer.

What is the best way to prevent an account from logging on, accessing the network, reading webmail etc. but not disable it? Can I do this with a policy or something like that?

Thanks in advance!

[FAT64]

One way would be to ...

1. Go to the Properties of the desired account within AD Users & Computers

2. Click on the Account Tab

3. Click on the Logon Hours button

4. Select all the cells and click in Logon Denied.

A bit clumsy I know. However you can multi-select accounts.

I don't think it can be done via Group Policy.

Edited December 21, 2006 by FAT64

[mkools]

Thanks FAT64, that seems like a good solution!