time restrictions web-application

[browolf]

time restrictions would be amazingly handy for controlling certain naughty kids if only I had more control over the times. as it is the one hour slots barely line up with our timetable. never the mind the fact our timetable runs in 2 week rotations.

 

I've surmised it'd be possible to make a web-based application to control it. ie admin of it can be hived off to the ICT coordinator.

 

so you'd put in a kid's username and get presented with a table representing the timetable. clicking on cells would change bgcolor representing enabled or disabled periods. saving would write the info into some kind of data structure.

 

a script would be scheduled to run at the beginning and end of lessons. it would enumerate the data in such a fashion to enable and disable the accounts.

 

a page would also exist whereby technicians/teachers can temporarily enable a pupils account for a lesson without it permanently altering their logon restrictions. for us that would be kid brings a note from their teacher.

 

 

 

such a system needn't be overly complicated, in terms of ad connectivity. you need to verify the kids user name at the beginning of the creation process. after that any data relating that kid is assumed to be correct. And also when the scheduled script runs to disable/enable accounts.

 

I know such a thing is possible, I've been thinking about it for a while. I cant figure out how i'd store the data in flat files. not least that I despise databases in ASP. It's too complicated for my head.

 

If anything thinks they could make this, I reckon it'd be pretty handy to quite a few people. (to run in asp on an iis domain controller)

[Michael]

I would of thought a proxy would be the best way to go. Something like ISA server, you should be able to implement time restrictions.

[Geoff]

Smoothwall can do this, as of course, can dansguardian.

[browolf]

those things are do with internet access no?, (already have stuff managing all that)

 

i'm talking about logging on. sorry if i didnt make that clear.

[SYNACK]

Would it not be easier to simply write the ristriction times into the account logon restriction bit of Active Directory using ADSI. You should be able to both write to and read from this using ASP with the correct access rights.

 

This would also mean that you would not need the extra database layer or the scheduled task and would mean less writes to AD as you would only need to write anything that changed. A mass disable/enable could cause you issues if you have multiple servers as it will entail a lot of writes and replication data to perform it. If a student that had just been diabled tried to log in and got one of the other servers that had yet to replicate the changes they would still get on.

[browolf]

Would it not be easier to simply write the ristriction times into the account logon restriction bit of Active Directory using ADSI. You should be able to both write to and read from this using ASP with the correct access rights.

 

yes thats possible but because our lesson times vary considerably from the hour by hour format of logon restrictions the idea is to create a system thats far more accurate.

 

our period 3 goes from 11:15 - 12:15

using the built in timing we have to allow 11:00-1:00, which somewhat defeats teh point of restricted logins.

[SYNACK]

yes thats possible but because our lesson times vary considerably from the hour by hour format of logon restrictions the idea is to create a system thats far more accurate.

 

our period 3 goes from 11:15 - 12:15

using the built in timing we have to allow 11:00-1:00, which somewhat defeats teh point of restricted logins.

 

For some reason I thought that the logon times were configurable in 15 minute blocks, my bad. I would be concerned about all of the replication traffic though, it might be easier to implement a check of your DB in the logon script to make sure that they are allowed to logon and kick them if they are not. You may need to use super mandatory profiles to be sure that they simply did not yank the network cables at logon to bypass it though.