Using GP - prevent a user on more than one pc?

[tarquel]

Hi all

 

Just wondering where it is that I can configure how to prevent users from logging onto more than one machine at the same time...

 

Another thing I'm sick of, but not had the chance to find it...

 

Cheers (eeek thats the time? 8O 8O )

N.

[russdev]

would also like to know that as well

 

russ

[ConTheITGuy]

You would think that's bread and butter Network Operating System stuff wouldn't you? But nope! The MS way points to something called CConnect - to be found in the Windows 2000 Resource Kit (not sure if it's in the 2003 one) - which is a couple of VBS scripts and requires a SQL Server (or MSDE I believe) database. Seems a lot of work for something that sounds so simple. I believe Netware just needs you to tick a box (or similar)!

 

Andy.

[Ric_]

I never actually got CConnect working but it does have some good features. For instance if a user doesn't log off cleanly (e.g. they switch off the machine), they will be unable to log on to any machine until they log back onto that one and log off properly.

 

This can of course be overridden.

[ChrisH]

There was supposed to be a new more stable version in development but that aeems to have been lost to the ether!

[tarquel]

Interestin....

 

So no one knows of a "tickbox" option in GP of Server 2003 then?

 

Surely there must be an easier way than the CConnect thing, tho I have MSDE runnin on the DC so maybe I could try it

 

Cheers but preferably other options please

Nath

[MkII]

You don't mean enforce a user to only be able to login to one machine do you - but block a user from several PC's, not all I presume...?

[ConTheITGuy]

I think I know what you're getting at there - even that's a pain. I have 4 teacher machines where it would be desirable to restrict student's access to them. So can I say DO NOT ALLOW LOGON TO such a machine - NOPE! I have to say ALLOW LOGON TO the other 120 machines instead!! (and also do that for each of the 400 kids!).

[tarquel]

lol

 

No, as I said, I mean "prevent a user to logon to another computer while they are already logged on".

 

I'm sure I was able to do it on the NT domain so what happened MS? lol

 

Nath

[Geoff]

http://support.microsoft.com/?kbid=237282

 

In short, use CConnect.exe from the resource kit.

[MkII]

Oh sorry - didn't read your first post

 

Citrix does that out of the box: I turned it off coz I had so many ppl unable to log on if their session bugged out and didn't log off properly.

 

I prefer the logging method to combat the problem.

[tarquel]

http://support.microsoft.com/?kbid=237282

 

In short, use CConnect.exe from the resource kit.

 

Ah ha - didn't notice these replies

 

*mutters 'shoddy forum' * [jokin]

 

Hope theres one for 2003 - shall look later..

 

Citrix - bah! @ mark

 

Nath

[Geoff]

The version from the w2k resource kit works fine on 2k3 sp1 with xp sp2 clients.

[tarquel]

excellent news - thanks Geoff

 

N.

[mikeingham]

For win2k3 server you can use LimitLogin.exe.

 

Downloadable from Microsoft

 

Make sure that you read all the documentatuion that goes with it, as there are quite a few other requirements to get it working.

 

It definitely works - already had a few complaints.

[tarquel]

Hi - and thanks for postin'

 

You have a link at all?

 

Ta,

Nath

[Geoff]

http://www.microsoft.com/technet/technetmag/issues/2005/05/UtilitySpotlight/default.aspx

[neilenormal]

I think I know what you're getting at there - even that's a pain. I have 4 teacher machines where it would be desirable to restrict student's access to them. So can I say DO NOT ALLOW LOGON TO such a machine - NOPE! I have to say ALLOW LOGON TO the other 120 machines instead!! (and also do that for each of the 400 kids!).

 

Here is one possible solution that we use here:

These lines are from our KIX logon script. KIX is the quickest and easiest way of determining group membership at logon time. Our machine naming convention is "Room number" followed by "Machine number" OR "teacher" [so student PCs are 0101 and teacher PC called 01teacher in Room 1]

 

==

if instr(@wksta, "teacher") <> 0 & ingroup("students") = 1

$r = messagebox("Students are not allowed to logon to this machine!", "Warning",4160)

logoff(1)

goto exit

endif

==

 

Neilenormal

[ChrisH]

Anyone else implemented limitlogon yet? The fact it makes it's own partition in AD stops me from jumping in and testing it at this time due to other changes I have been doing to AD.

[tarquel]

I'll be trying something this week or next so stay tuned

 

Nath

[GrumbleDook]

I think I know what you're getting at there - even that's a pain. I have 4 teacher machines where it would be desirable to restrict student's access to them. So can I say DO NOT ALLOW LOGON TO such a machine - NOPE! I have to say ALLOW LOGON TO the other 120 machines instead!! (and also do that for each of the 400 kids!).

 

Why don't you just use the "deny logon locally" bit from the GPOs ... stiick all students in a security group and then add this group to the deny logon locally section of the policy.

 

That way you can add or take people away from logging onto certain workstations as you need.

[russdev]

anyone know how well or not this works with cc3...

 

Russ

[Ric_]

anyone know how well or not this works with cc3...

 

The way I understand it is that CC3 is AD with GPOs - at least that's how it was explained to me by the RM salesperson tthat came to see me (I was humouring them).

[russdev]

it is but this is rm we are talking about and they have mucked around it so much might be interesting to get it to work....

 

hence why i asked if anyone has used it on cc3

[ConTheITGuy]

Why don't you just use the "deny logon locally" bit from the GPOs ... stiick all students in a security group and then add this group to the deny logon locally section of the policy.

 

That way you can add or take people away from logging onto certain workstations as you need.

 

Interesting... trying it now...