Restrict Concurrent Logons using Domain Sessions?

[Nick_Parker]

Hi All,

 

I've been looking around at solutions to restricting users to only one logon, I've looked at cconnect (which I'm still trying to track down - need Server 2000 tools or something) and the other option is a fairly expensive UserLock software.

 

Other people have come up with clever ways of doing it using logon scripts to write to text files, or create folders or write to an SQL DB, but...

 

If you goto the domain controller, and right click 'My Computer', go to Manage, then under 'Shared Folders' you go to 'Sessions'.

 

I would assume that's a fairly accurate way of determining who is logged on where? (Please feel free to comment on just how accurate this is?)

 

Next question, is it possible to query the 'Sessions' from a vbscript startup script?

 

Any suggestions would be greatly recommended?

[Michael]

I use Userlock at one site (but as you say, it's expensive). Microsoft have release a free utility called LimitLogon, however I never got it to work properly and I don't seem to be the only one!

[kesomir]

This is one feature of ranger / impero etc that could really do with replicating on vanilla.

[FN-GM]

We use a logon script that makes a .txt file on a server. When the user tries to logon again it logs them off right away. Simple but effective.

[DMcCoy]

limitlogon here

 

Sometimes sessions can get left behind, although the same applies to limitlogon too if a machine crashes.

[Gatt]

Using Userlock here too - though not tried it on Windows 2008 & Vista yet!!

[Nick_Parker]

Ta for your suggestions guys,

 

I've been a bit sceptical of LimitLogon after Google'ing it and seeing pages of "problems installing" and we are about to move our DC/AD to Server 2008, does LimitLogon work on 2008?

 

None of you have tried the 'Sessions' route? I'm asking because I have no idea how to go about it myself

[amfony]

im not to sure about the legitimacy of the session model sorry dude, isnt a session (im thinking, no real data to confirm this) only applicable as long as there is a file being accessed on that server. So on the DC (which one? another potential problem in session model) unless i file is accessed i would assume the session would dissapear.

 

I could be very wrong though and id like to hear the result of someone knows otherwise.

 

What i do - do is use is what you correctly said already. A MySql DB to write on logon and clear flag on logoff. Across about ...500 - 600 student logons a day we only get about 2 or 3 students whom have computer crashing/mate pulled the power plug/other non-graceful logoff which i think is pretty fair.

 

Besides the txt file writing, database manpulation methods i dont really think there are other methods of achieving this? Thinking way, way, way out of the box (as i do) you could enable auditing and run scripts against eventLog??

 

Possible .. and improbable.

 

What aspect of the txt writing, db manipulation is not sufficient for you needs anyway mate?

[FAA]

Yes UserLock is Windows Server 2008 and Vista compatible.

[cookie_monster]

How expensive is UserLock?

[FAA]

UserLock pricing

 

Academic institutions get a 20% educational discount off this pricelist.

[Nick_Parker]

im not to sure about the legitimacy of the session model sorry dude, isnt a session (im thinking, no real data to confirm this) only applicable as long as there is a file being accessed on that server. So on the DC (which one? another potential problem in session model) unless i file is accessed i would assume the session would dissapear.

 

I could be very wrong though and id like to hear the result of someone knows otherwise.

 

What i do - do is use is what you correctly said already. A MySql DB to write on logon and clear flag on logoff. Across about ...500 - 600 student logons a day we only get about 2 or 3 students whom have computer crashing/mate pulled the power plug/other non-graceful logoff which i think is pretty fair.

 

Besides the txt file writing, database manpulation methods i dont really think there are other methods of achieving this? Thinking way, way, way out of the box (as i do) you could enable auditing and run scripts against eventLog??

 

Possible .. and improbable.

 

What aspect of the txt writing, db manipulation is not sufficient for you needs anyway mate?

 

You may be right about the sessions method, will have to look into it a little more, but I'm beginning to lean towards the MySQL method, do you read/write to the MySQL DB from the logon/logoff script?

[Nick_Parker]

LAME!

 

I spent most of yesterday writing a console application in C# to handle the talking to a DB, you pass it the parameters such as username, IP address, computer name.

 

It then looks up from a mysql db all the current sessions for that username, adds a new one if appropriate, logs off if necessary etc.

 

First problem: Can't run the EXE from the netlogon folder... all sorts of permission errors blah blah...

 

So for testing, the logon script now copies the exe to the local machine then runs it.

that seems to work fine, but still not ideal.

 

second problem: The logoff script doesn't seem to run the exe... when you log off, the desktop dissapears and you get that little status thingy, "windows is logging you off", "closing network connections..." etc... that stuff, then it does the "running log off scripts"

and I think at that point its not capable of running an .exe and doing the whole mysql bit.

 

 

Any suggestions?

[Nick_Parker]

Correction: It does run now when you log off, turns out I had a mistake in my logoff script... *oops*

 

Still, any suggestions as to how to get the exe to run from a network drive?

[SYNACK]

I have not had issues with running exe files from the nelogon share but stuff like the old winnt printer connector exe.

 

You are probably having problems because your app is built in C# and relys on the .net framework which has a whole bunch of security settings that prevent running a .net application from a network share. You would need to change the .net runtime security settings on all of your client machines.

 

You can use VBS scripts to access databases directly and perform the kinds of operations that you are after which may be easier that a full scale war with the .net framework.

[Nick_Parker]

It is to do with the .net securities... bugger

 

It's starting to look like I may have to rewrite it all as a vbscript, which is a pity, cause I was so proud of my little .exe

[Nick_Parker]

I have not had issues with running exe files from the nelogon share but stuff like the old winnt printer connector exe.

 

You are probably having problems because your app is built in C# and relys on the .net framework which has a whole bunch of security settings that prevent running a .net application from a network share. You would need to change the .net runtime security settings on all of your client machines.

 

You can use VBS scripts to access databases directly and perform the kinds of operations that you are after which may be easier that a full scale war with the .net framework.

 

Using the VBS Script to access databases directly, you would use an ODBC connector rite? Seeing as this is a logon script run from a network share, would that ODBC driver need to be installed on each client?

[kesomir]

Why not use the vbs to call a webpage and pass info to it (in the url?), then process it using whatever script you like - asp, php etc.

 

Almost tempted to knock something up myself, but am against time atm.

 

EDIT: Or share from webserver and run a script file that way which does what you want

Edited August 17, 2008 by kesomir

[Nick_Parker]

Why not use the vbs to call a webpage and pass info to it (in the url?), then process it using whatever script you like - asp, php etc.

 

Almost tempted to knock something up myself, but am against time atm.

 

EDIT: Or share from webserver and run a script file that way which does what you want

 

That's not a bad idea...

 

Could you elaborate a little more on the running a script from a webserver bit please?

 

The one thing that keeps niggling at me is that I need to just bite the bullet and do it properly using vbscript + odbc, i'm just worried about the ODBC availablility to connect to mysql on each client

[kesomir]

I run *nix webservers, so in my instance I would create a samba share with a batch file, php file, perl file etc that manipulates the database with the parameters it's passed.

 

The advantage first method of calling the webpage is that it's probably very familiar for the variable passing, but you may need to launch a webbrowser (then close it) to do it??

 

The second method is basically the same implementation as your .exe but calling a script on the webserver. This avoids the problems with your .net security. Advantage of doing it on *nix is that the script can be almost any flavour you want - including php.

 

If you were doing it on windows, you're a bit more restricted in the languages you can use - I don't know if you can execute php from the command line in windows but you can easily on a shell.

 

it would look something like this: calling 'concurrent_users.sh type username hostname'

#!/usr/local/bin/php -q

//grab the parameters

//type
$type = $argv[1];

//username
$username = $argv[2];

//hostname 
$hostname = $argv[3];

// execute the database call and make the write from the passed parameters

switch($type){
case 'logon':
//check to see if logged on and if time isn't beyond auto expire
//write logon data inc time etc
//allow logon
data['permit'] = TRUE;
//or not
data['permit'] = FALSE;
data['other_host'] = xxx;
break;

case 'logoff':
//delete instance of user on this hostname
break;
}

return $data;

?>

 

You then have to logoff immediately if the returned data is FALSE and you get the hostname backto give them a message "you are currently logged on to machine: xxx. Max Logons is X, you have exceeded this, you will need to log out of a machine to log in to this one. If you believe this is an error, please contact your system administrator - blah blah"

 

Thats a rough outline, the problems to solve would involve the returned data and the execution of the logon script.

 

EDIT: heh - easiest way would prob be using text files as an intermediary, which I think is the current solution. This sophisticates the whole thing by adding the database, configurable settings etc.

Edited August 17, 2008 by kesomir

[SYNACK]

To access a MySQL DB you would need the ODBC connector installed on each machine, luckily though it is provided as a MSI so deploying it with GP would be a snap:

MySQL :: MySQL Connector/ODBC 5.1 Downloads

 

The web idea is an interesting one though as it would limit your requirements for connecting to only one server.

[azrael78]

The only issue I can see with using a DB of any kind is ghost sessions, where the kids don't bother to logoff but simply shut the PC down.

 

You might want to add some way to easily clear a session from the database if you are going to do it that way - as for me, I'm looking at a bunch of text files that can easily be deleted if we have issues or can easily free up sessions based on PC identity rather than user identity - but this is all ideas in my head and I need manglement approval to implement something like this.

 

Az

[amfony]

The only issue I can see with using a DB of any kind is ghost sessions, where the kids don't bother to logoff but simply shut the PC down.

 

Yeh - like i said it happens. Kids whom have the incentive to ask a teacher to ask us in IT gets cleared (i wrote a liveLogon app in autoIT to see who is on what computer at all times and made a simple click and delete record type deal).

 

Better yet (i think) is when a kid says "umm it says im logged in somwhere else" i can say "so what happened to the computer?" or "why did you press the power button?" and 90% of the time its a spot on inference. Also lets me know when a computer is freezing up etc.

 

To access a MySQL DB you would need the ODBC connector installed on each machine

 

Exsactly and exsactly. It does require a supplimentary install but it is so beautifully packaged that its a comprehesive non-event.

 

First problem: Can't run the EXE from the netlogon folder... all sorts of permission errors blah blah...

 

So for testing, the logon script now copies the exe to the local machine then runs it.

that seems to work fine, but still not ideal.

 

Ehh i think Synack's response might help you with some other auxilliary issues which i am useless to answer, but i have compiled all my logon scripts (as in AutoIT "compiled") and have them residing deep in the group policy folder strcuture in sysvol. And yes the DB manipulations run at logon and logoff, and computer start up and shutdown.

 

Hope this helps mate!

 

(PS: I actually quite like the web page medium for user logon/offs -- well done Kesomir)

[Nick_Parker]

The only issue I can see with using a DB of any kind is ghost sessions, where the kids don't bother to logoff but simply shut the PC down.

 

You might want to add some way to easily clear a session from the database if you are going to do it that way - as for me, I'm looking at a bunch of text files that can easily be deleted if we have issues or can easily free up sessions based on PC identity rather than user identity - but this is all ideas in my head and I need manglement approval to implement something like this.

 

Az

 

There will be a web front end which acts as a monitor as to who is logged on where (an advantage of having a DB store all the info)...

There will always be problems, but hopefully limiting concurrent logons will be a bigger benefit

[Nick_Parker]

To access a MySQL DB you would need the ODBC connector installed on each machine, luckily though it is provided as a MSI so deploying it with GP would be a snap:

MySQL :: MySQL Connector/ODBC 5.1 Downloads

 

The web idea is an interesting one though as it would limit your requirements for connecting to only one server.

 

OK, i'm sorry, this is probably going to sound really daft, but how would I go about doing that? I've never used GP to install stuff, I usually hold off till the next ghost image, but that could be a long way off for the time being.

I tried reading up on it, the one article says that it isn't actually installed until a user tries to use it, what would happen if a script tried to call it?