Using Logon Rights to Secure AD Service Accounts

Q: How can I secure the Active Directory (AD) service accounts so that no one can use them to log on to our network?

A: Logon rights provide an elegant way to prevent users from logging on with accounts that you've created expressly for a service. There are five logon rights, each of which governs whether an account can log on a certain way. You can find these logon rights in the Microsoft Management Console (MMC) Group Policy Object Editor snap-in under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Right Assignments. Windows requires you to have the Access this computer from the network logon right to access anything provided by your server or Microsoft IIS. You need the Log on locally right to log on interactively at the console of a computer and the Allow log on through Terminal Services logon right to log on via an RDP connection. These are the only logon rights a user can directly use. The other two rights, Log on as a batch job and Log on as a service let scheduled tasks and services run under a specified account. . . .