Sounds reasonable as long as they only get the accessed denied when logging on.
I think you have it.
- Tom