diff --git a/admin/webservice/forms.php b/admin/webservice/forms.php
index b95935c6e04..dab9a42f661 100644
--- a/admin/webservice/forms.php
+++ b/admin/webservice/forms.php
@@ -179,7 +179,7 @@ class external_service_functions_form extends moodleform {
 class web_service_token_form extends moodleform {
 
     function definition() {
-        global $USER, $DB;
+        global $USER, $DB, $CFG;
 
         $mform = $this->_form;
         $data = $this->_customdata;
@@ -194,9 +194,12 @@ class web_service_token_form extends moodleform {
 
             if ($usertotal < 500) {
                 //user searchable selector - get all users (admin and guest included)
-                $users = $DB->get_records('user',
-                        array('deleted' => 0, 'suspended' => 0, 'confirmed' => 1), 'lastname',
-                        'id, firstname, lastname');
+                //user must be confirmed, not deleted, not suspended, not guest
+                $sql = "SELECT u.id, u.firstname, u.lastname
+                            FROM {user} u
+                            WHERE u.deleted = 0 AND u.confirmed = 1 AND u.suspended = 0 AND u.id != ?
+                            ORDER BY u.lastname";
+                $users = $DB->get_records_sql($sql, array($CFG->siteguest));
                 $options = array();
                 foreach ($users as $userid => $user) {
                     $options[$userid] = $user->firstname . " " . $user->lastname;
diff --git a/admin/webservice/tokens.php b/admin/webservice/tokens.php
index ec06e23185f..cf229ab5446 100644
--- a/admin/webservice/tokens.php
+++ b/admin/webservice/tokens.php
@@ -71,6 +71,12 @@ switch ($action) {
                 }
             }
 
+            //check if the user is deleted. unconfirmed, suspended or guest
+            $user = $DB->get_record('user', array('id' => $data->user));
+            if ($user->id == $CFG->siteguest or $user->deleted or !$user->confirmed or $user->suspended) {
+                throw new moodle_exception('forbiddenwsuser', 'webservice');
+            }
+
             //process the creation
             if (empty($errormsg)) {
                 //TODO improvement: either move this function from externallib.php to webservice/lib.php
diff --git a/lang/en/webservice.php b/lang/en/webservice.php
index 6bc4e0397e0..7eb7ce449aa 100644
--- a/lang/en/webservice.php
+++ b/lang/en/webservice.php
@@ -92,6 +92,7 @@ $string['externalservices'] = 'External services';
 $string['externalserviceusers'] = 'External service users';
 $string['failedtolog'] = 'Failed to log';
 $string['filenameexist'] = 'File name already exists: {$a}';
+$string['forbiddenwsuser'] = 'Can not create token for an unconfirmed, deleted, suspended or guest user.';
 $string['function'] = 'Function';
 $string['functions'] = 'Functions';
 $string['generalstructure'] = 'General structure';