DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:reply-to:message-id:to:subject
	:in-reply-to:references:mime-version:content-type
	:content-transfer-encoding; q=dns; s=default; b=JaF+iUhmk6+TZal2
	bURlyjZoXeSCVeNRyaIkG5P5M1lqySKUgIRNyE7Rv+K05JgG/Ff12jXs6wOkp6pd
	UVFK+iGTNWxBm/DQIFFP8wryEqaqXrLW8Gt4K/OKglnu5V8a23crhdVbHKiWoMcu
	qgOOl/J3Xm0sHOqogdMgYSs8C8c=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Date: Thu, 10 Jan 2019 03:05:23 +0300
From: Andrey Repin <anrdaemon@yandex.ru>
Reply-To: cygwin@cygwin.com
Message-ID: <1003498871.20190110030523@yandex.ru>
To: Bill Stewart <bstewart@iname.com>, cygwin@cygwin.com
Subject: Re: csih_create_privileged_user - use of SeDenyInteractiveLogonRight
In-Reply-To: <CANV9t=QQDCwDghXo=fXS-stfZqbnWxdb3SS1U7xD8gcEGdDiGA@mail.gmail.com>
References: <CANV9t=QQDCwDghXo=fXS-stfZqbnWxdb3SS1U7xD8gcEGdDiGA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Greetings, Bill Stewart!

> Is this correct? In other words, is preventing the account from showing in
> the logon screen the _only_ reason for adding SeDenyInteractiveLogonRight?

No, SeDenyInteractiveLogon prevents user from creating console sessions, local
or remote. This is what service accounts are never supposed to be doing.
Yes, by the extension, it will hide the user from welcome screen.


-- 
With best regards,
Andrey Repin
Thursday, January 10, 2019 3:02:28

Sorry for my terrible english...


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple