Active Directory account disabling

[blu4]

Hey,

 

We have a few students that have been banned from the network- I have to disable their account manualy every break and lunch and then enable after. If there a way of automating this with a script? The logon hours on AD are not good enough.

[sted]

you could script it with powershell

 

Disable-ADAccount -Identity fred

 

enable-ADAccount -Identity fred

 

as always with powershell works better with latest version of ps you can get on the pc but just tested it on an 08r2 box and as long as you have the ad module loaded works fine

 

just tried it on a 2012 r1 server (non dc) and it loads the module for you and just works

Edited November 19, 2014 by sted

[AlexB]

This script is assigned to run at login by group policy for members of a particular group. That way if they are a member of (for us) LessonOnlyAccess then they will be force logged off outside of lesson time. Sadly our timetable is a PIA and hence the differences between days.

 

 

vHour = Hour(now)
vMinute = Minute(now)
vDay = Weekday(now)
' 1 Sunday
' 2 Monday
' 3 Tuesday
' 4 Wednesday
' 5 Thursday
' 6 Friday
' 7 Saturday

If vHour < 9 or vHour > 15 then ' Before 09:00 or after 16:00
RejectAndLogLessonOnlyAccess
elseif vHour = 11 and vMinute < 20 then ' Before 11:20
RejectAndLogLessonOnlyAccess
elseif vHour = 12 and vMinute > 19 then ' After 12:19
RejectAndLogLessonOnlyAccess
elseif (vDay = 2 or vDay = 6) and vHour = 13 and vMinute < 15 then ' Before 13:15 on Monday or Friday
RejectAndLogLessonOnlyAccess
elseif (vDay = 3 or vDay = 4 or vDay = 5) and vHour = 13 and vMinute < 35 then ' Before 13:35 on Tuesday, Wednesday or Thursday
RejectAndLogLessonOnlyAccess
elseif (vDay = 2 or vDay = 6) and vHour = 15 and vMinute > 14 then ' After 15:14 on Monday or Friday
RejectAndLogLessonOnlyAccess
elseif (vDay = 3 or vDay = 4 or vDay = 5) and vHour = 15 and vMinute > 24 then ' After 15:34 on Monday or Friday
RejectAndLogLessonOnlyAccess
end if


Function RejectAndLogLessonOnlyAccess()
rem logoff(1)

Set wshShell = WScript.CreateObject ("WSCript.shell")
wshshell.run "shutdown /l /f"
'wscript.echo "You are not allowed to use the computers outside of lesson time"


end function

 

This does not prevent them staying logged in once a lesson ends, but that wasn't an issue for us...

Edited November 19, 2014 by AlexB

[Boredguy]

You could set a scheduled task up on the server to enable/disable the account a few minutes before you want to prevent them from logging on.

 

Normally when we ban students from the network, we generate a random password and only staff can look it up and they have to log the student on (and we prevent that user from changing the password)

[p3dr0]

there is an "Account" tab in properties which will allow you to specify log on hours for that account which should do the trick