when a user is created, there is a checkbox to allow them to login as an actual user or just being able to be used as "run as".
eg.
I may want to create an ASP user to run my IIS as, but I don't want anyone to login as that user; a service only user.