I'm not sure if I'm in the right area of the site but I'll try here anyway. I'm in charge of network configuration at my job and the company's system is set up that the exchange server (where our email comes in) is the same server that our profiles are stored on. Anyway I've been given the task of configuring the profiles so that they can only log on to specific computers on our network. I've accomplished this, but part of that configuration says that the average user can't log on to the physical server (only administrators can). The problem with this is that when the average user tries to access the exchange email web address and they put in their user name and password, they are not granted access. So my question is how can I block the user from logging on the physical server but still be able to log on to the exchange web mail? Any help or ideas would be greatly p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm;margin-bottom:.0001pt;font-size:12.0pt;font-family:'Times New Roman';} @page Section1 {size:612.0pt 792.0pt;margin:72.0pt 90.0pt 72.0pt 90.0pt;} div.Section1 {page:Section1;} appreciated.

You need to restrict "Log On Locally". It seems you have restricted Local and network access to users which prevents them from accessing their mailboxes as server denies the connection per policy.

Thanks, but how do I restrict "Log On Locally"? Where on the server will I find that option (as it is only the server that I'm having the problem with.)

Never mind. I figured it out. Thanks for your help though.

From Group Policy Editor, go to Computer Configuration -> WindowsSettings -> Security Settings -> Local Policies -> User Rights Assignment. Here check the "Deny Log on Locally" for your desired configuration.