Read only user - using copSSH and Active Directory

Latest in my random technical achievements - setting up a read only user for my company's SFTP server,

I was quite foxed, as I first thought this was set in NTFS permissions (right click, Permissions, add user, etc) , then perhaps it was set in sshd-config..no, no no...!

Was quite hard to find it, but hopefully this post will make it easier for you.

1. Set up your user in Active Directory. eg. barney

2. Set up a group in Active Directory eg. ReadOnly

3. Assign your user to the new group

4. Go to Administrative Tools -> Domain Controller Security Policy

5. Expand the Local Policies, and click on 'User Rights Assignment'

6. Find the 'Allow log on locally' option, right click -> Properties

7. You should have a bunch of groups already set, as I did, but you need to click on 'Add User or Group...' eg. ReadOnly, click on 'Apply' / 'OK' etc.

8. Start the copSSH 'Activate a user' wizard, choose the user to activate (or just type their username in), and make sure the shell type is bash/sftponly. Create a suitable passkey as appropriate.

9. You should now be able to log in read only with this new user via WinSCP.