Allow Secondary Logon But Deny Interactive Logon

[Gantlett]

Hello Everyone

We are using an old program (Microsoft Visual SourceSafe 6.0) which requires Domain Admin rights to connect to the database.

I'd like to set up an account with Domain Admin rights so that regular users would be able to use "Run As..." (Secondary Logon) for Microsoft Visual SourceSafe 6.0 and use the program as a Domain Admin without them knowing actually (When they double-click the program shortcut which already contains the "Run As..." syntax they are prompted for a user password, but that's fine).

I don't want anyone to be able to log on to any computer in the domain using this account. In other words, this account should only be used to run in Secondary Logon mode and not in Interactive Logon mode.

The problem is that if I use Group Policy to deny interactive logon for this account, it is also impossible to use it with the "Run As..." feature.

The error I receive is this:

RUNAS ERROR: Unable to run - Microsoft Visual SourceSafe 6.0
1385: Logon failure: the user has not been granted the requested logon type at this computer.

Is there a way to deny a user Interactive Logon but allow it Secondary Logon?

Thanks very much,
Gant.