Using GP - prevent a user on more than one pc?

[russdev]

This is in this months windows it pro...

 

Prevent Multiple Logons With GPOs

 

Readers

Reader to Reader

InstantDoc #46952

Windows IT Pro

 

DOWNLOAD THE CODE:

46952.zip

 

 

IT Jobs at Dice

 

Search 65k+ new IT jobs daily. Tech jobs at top companies.

 

As a Microsoft Certified Trainer (MCT), I'm frequently asked about providing a solution that prevents a user from logging on to multiple PCs at the same time. There's a Microsoft solution to prevent multiple logons, but it's complicated. I found a simpler solution that uses logon and logoff scripts in Group Policy Objects (GPOs). Because GPOs can't be applied to Windows 9x or Windows NT, my solution works with only newer OSs (i.e., Windows Server 2003, Windows XP, and Windows 2000).

 

There are three steps in my solution:

Create and share a folder on the domain controller (DC). For this example, I created a folder named Logons on a DC named Rafetpc. The share name should be the same as the folder name (in this case, Logons). The share permission must be Everyone, Change because users will write and delete files on the DC.

Download and customize Login.bat, which Listing 1 shows, and Logout.bat, which Listing 2 shows. You can download these scripts from the Windows IT Pro Web site. Go to http://www.windowsitpro.com, enter 46952 in the InstantDoc ID text box, then click the 46952.zip hotlink. To customize these scripts, replace each instance of \\rafetpc\logons\ in the code at callout A in Listing 1 and at callout A in Listing 2 with an appropriate path.

In the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in, go to the organizational unit (OU) that contains those users for whom you don't want to allow multiple logons. Create a GPO for this OU. In this GPO, navigate to User Configuration, Windows Settings, Scripts (Logon/Logoff). In the details pane, double-click Logon. Click Add in the Logon Properties dialog box, then click Browse in the Add a Script dialog box. Select the Login.bat file and click OK. Repeat the process for the logoff script by double-clicking Logoff in the details pane, clicking Add, Browse, selecting the Logout.bat file, and clicking OK. That's all.

 

After performing these steps, whenever a user in the specified OU logs on, Login.bat will create two files in the folder on the DC. When the same user attempts to log on from another PC at the same time, Login.bat will check for the existence of these files. If the files are present, Login.bat will immediately log the user off from the second PC. When a user in the specified OU logs off from a PC, Logout.bat will delete the two files created by Login.bat so that the user can then log on to another machine.

 

—Murat Yildirimoglu

[email protected]

 

List 1

Listing 1: Login.bat

 

:: BEGIN CALLOUT A

If Exist \\rafetpc\logons\%username%.txt Goto notlogon

Echo %username% logged in from %computername% > \\rafetpc\logons\%username%.txt

Echo %username% logged in from %computername% > \\rafetpc\logons\%computername%.txt

:: END CALLOUT A

Goto end

:notlogon

Logoff

:end

 

List2

 

Listing 2: Logout.bat

 

:: BEGIN CALLOUT A

If Not Exist \\rafetpc\logons\%computername%.txt goto notlogon

Del \\rafetpc\logons\%username%.txt

Del \\rafetpc\logons\%computername%.txt

:: END CALLOUT A

Goto end

:notlogon

Logoff

:en

 

For subscribers here is the url http://www.windowsitpro.com/Windows/Article/ArticleID/46952/46952.html

 

going to try this tommrow on rm network...

 

Russ

[MkII]

Cool - let us know how it goes wontcha

[Ric_]

It's pretty obvious really - so obvious that none of us thought of it!

[russdev]

yep and that is why i pay 16 odd quid month for subscription to there websites as that one article has saved me many many man hours doing something else..

 

saying that having fun trying to get it to work on cc3 network once i know it works will post how to do it...

 

Mainly as need to customize batch file to keep certain rm stuff working..

 

Russ

[russdev]

well got it working on staff users on rm cc3

 

next one student users keeps hanging at login..

 

looks like something to do with restrictions....

 

It is fun to get it work with cc3

 

Russ

[ChrisH]

Burn the RM !!!!!

[tarquel]

lmao

 

I gotta try this one

 

*slaps himself for not coming up with that sooner*

 

A bit of tweaking I shall do tho

 

Need to sort out my logon scripts anyhow

 

Will let ya know if i come up with any improvements to this

 

 

 

Cheers

Nath

[ChrisH]

I will give it a try but will convert to VB script to put in my main scripts.

[russdev]

chris can i have the vbscript (saves me doing it) as was trying it using batch file but rm for students lock it down to tight to run batch file scripts but allows vb scripts to runn on login..

 

Russ

[ChrisH]

Sure I will do but might be a few weeks as Im on my 2 week break so might start writing it but wont be tested properly.

[russdev]

that ok might work on something in next week as well then merge what we have got...

 

mainly as need to sort after get back next week but still anything you got brill

 

russ

[SpuffMonkey]

Anyone else implemented limitlogon yet? The fact it makes it's own partition in AD stops me from jumping in and testing it at this time due to other changes I have been doing to AD.

 

Yeah - I've done the Limitlogon thing - it works fairly well - though I do have to check the logs each day for kids that have just switched the PC off without logging off. Also it misses a few logoffs with an error that I forget at the minute. It'd work better if I could find a way of stopping the kids swapping their paswords... :?

[Ric_]

It'd work better if I could find a way of stopping the kids swapping their paswords... :?

 

A large, pointy, stick?

[GrumbleDook]

It'd work better if I could find a way of stopping the kids swapping their paswords... :?

 

A large, pointy, stick?

 

Point out that if they share passwords and there is doubt about who has actually written a piece of coursework they could both be disqualified from their exams by the exam board.

 

I usually tell them about when I was in the army and had to look after a guy in our jail who got 14 days for sharing passwords ... but he was in the pensions dept and someone had been using his account to sort out extra money for friends who had left.

[Ric_]

@GrumbleDook: I like your coursework reasoning. I usually just explain that if somebody's account is used to do something dodgy on the Internet, it is the owner of the account that will be held responsible.

 

Of course I use a raised tone of voice to hammer it home.

 

If someone has 'stolen' a password, I am usually able to find out who it is (usually a 'friend'), I then disable the account and make them explain their actions.

[tarquel]

I guess tho, that the good thing about limiting login is that if someone else is logged in to a users account, then the user who holds the account wont be able to log in lol

 

ITs going to be especially useful when teachers logon for kids - for whatever reason (yes yes, i do tell them not to, but then again, who am i to tell them anything? lol)

 

Cheers

Nath

[ChrisH]

@russdev

 

I have done the script in and put in the scripts section

 

I think there are a few more things I could add to it such as time stamps and logging information to an SQL DB (as already mentioned by someone) at a later date.

[ChrisH]

I have been playing with this a little my a MYSQL DB and have the outline of the code. The only teething trouble I'm having is using the TIMESTAMP in MYSQL which doesnt seem to work properly for me at the moment.

I have two tables: One for current logons containing username and logon number. The other table is the history containing logon number, username, time logged on, time logged off, hostname etc.

The logon script searches Current_Logon table for the username to see if they are logged on. If they are then they are logged off and the information can be pulled from the history table to display to them. Im joining the two tables throught the logon number.

The log off script deletes the entry in the Current_Logon table.

Ive not got round to it but I will implement an ASP page to query the history.

 

Like I say just struggling with a few SQL bits as I have never impemented my own before just altered others.

 

Any suggestions welcome.

 

BTW MYSQL installation under windows is now so easy it's untrue!!!!

[tarquel]

BTW MYSQL installation under windows is now so easy it's untrue!!!!

 

Is that sarcasm or is it true? lol

 

Much of a load on the system on a 2k3 server?

 

N.

[RobC]

Well, I haven't had any problems installing MySQL under Windows, and I don't see much load at all on either 2k3 or XP. I've run it under both on my home systems.

[ChrisH]

You can give it as much or as little as you want it's all configurable. The only trouble I had was getting PHP to work at first. You have to enable old passwords in order for PHP to be able to authenticate properly.

I will be starting the database version of limit logon next week. It will use VB Script for log on and machine startup (incase machine crashes). I will also put an asp.net front end on it for reporting features and eventually some basic admin functions.

[fooby]

I have been running LimitLogon since monday and have disabled it, drove us nuts! so many students coming in all day long saying "hi yea i got a message saying im already logged on" got boring quickly so I dont think we will bother anymore

 

 

fooby

[ChrisH]

I have been running LimitLogon since monday and have disabled it, drove us nuts! so many students coming in all day long saying "hi yea i got a message saying im already logged on" got boring quickly so I dont think we will bother anymore

 

 

fooby

 

Is that because they were genuinely logged on or there was a problem with the script?

[CyberNerd]

We do this using Citrix, which has a tunable login limit.

It helps to stop students giving away their passwords to friends as they know their session will be blocked.

[ChrisH]

The option is there for terminal services as well but why they didnt do some kind of native function for normal logons as well is very annoying.