Making an account unable to login, but available over network

Question

I have the same group of employee user accounts on all iMacs in my airport network, but I would like to prevent certain users from logging into certain machines. Changing the account password on the forbidden machine is not the answer, since the users need to access files on the machine through the network (connecting as their own username). Long ago there was a simple way to prevent login to a valid account. Is that still possible?

Answer 1

So it sounds like you want to give other users access for file sharing, but not the ability to log in while physically sitting in front of the machine. If the file sharing is over AFP, a "sharing only" account may be suitable in this scenario:
..."You can share files on your computer with other users on a network by creating a sharing only account. A sharing only account allows users to connect with your computer just like a server. However you cannot physically log into a computer using a sharing only account name like you can with most other accounts."...
http://docs.info.apple.com/article.html?path=Mac/10.5/en/11776.html
It also may be necessary to configure individual shared folders appropriately and place the items to be accessed within them (see "System Preferences" > "File Sharing" > "Shared Folders").