restricting users to only one logon

[edie209]

I have just been made aware that a teacher is logging on students with her own username. Obviously this can't happen, I tried using limit logon yesterday and as yet I haven't really got it working.

 

Is there any other way of restricting logons to only one per user name? or something to notify me when it happens?

[GrumbleDook]

Easiest way ... tell the teacher involved that you will disable her account unless she stops. Inform whoever is in charge of data protection and let all other staff know that anything they have put in the shared areas that are only available to staff ... students now have access to because of this one user.

 

See how quickly she stops.

[edie209]

GrumbleDook, what you say is very valid and that is one angle I will take on this issue, but I would like to prevent this from happening again, or at least know a way of monitoring the network for this type of issue.

[webman]

Have a look at this suggestion

[edie209]

Thanks webman, this could be just what I'm looking for.

[mrforgetful]

I've seen that floating around for a long time, but I've always thought I'd wait for MS to pull their fingers our and implement it in an update.....still waiting, might stop waiting.

[acb_]

Have a look at this suggestion

 

This is very similar to a homegrown approach we tried here; we found one fatal flaw with it.

 

Often our users won't log off gracefully, in many cases they are more likely to hit the killswitch. This leaves the files created at logon in situ and the next time they try to logon they will get kicked off even if they are only logging on to the one machine.

[mrforgetful]

Have a look at this suggestion

 

This is very similar to a homegrown approach we tried here; we found one fatal flaw with it.

 

Often our users won't log off gracefully, in many cases they are more likely to hit the killswitch. This leaves the files created at logon in situ and the next time they try to logon they will get kicked off even if they are only logging on to the one machine.

 

Does this happen with the above mentioned method too then?

 

If so it's probably not going to work as people are very prone to just holding the power button, must be easier for them or something!

 

EDIT: Sorry yes, just read how it works and obviously if they turn off not log off it won't work.

[Face-Man]

I had a memeber of staff with the same issue total undermining our acceptable use policy and so after a "talk" with his line manager I added the four computers he need to use into the login workstation in AD as this stopped the excuss "the kids have hacked my password" (funny how easy that is when you tell them it). strangly he is no longer working here...

[webman]

Yes the only flaw with logon + logoff scripts is that if one doesn't run - the action it carries out doesn't happen. The only way round this is with a continuous executable setting some sort of "logged in" flag on a server every "x" minutes or something like that, and which expires every "x" minutes as well.

 

EDIT: Knew I had it somewhere I experimented with a VBS version of this ages ago and just remembered I had it. Never actually used it in production but tests were successful. It also includes an "excluded users" feature so you can allow certain users to log in more than once.

logon-once.zip

[MkII]

couldn't you just automate deleting all the logged on tokens at the end of every lesson?

[mrforgetful]

couldn't you just automate deleting all the logged on tokens at the end of every lesson?

 

What about teachers who stay in the same room all day and stay logged on? Or if a user needs to work though break/dinner/double lessons?

[webman]

And double-lessons? Or drop-in ones who don't follow the timetabled periods.

[IanB]

:idea: Another way around the problem of a user not logging off might be to have the logon script create a second token text file, named for the computer and containing the users name. This would also be deleted by the logoff script. The you could have a third script that runs every time the computer boots, to check for the computername token, then if it exists read the username from it and delete both tokens. That way if a machine crashes or the user just turns it off, the token will be cleared as soon as that machine comes on again.

What do you think?

[webman]

Excellent idea IanB

[edie209]

Webman I have just tried your vbs download but I can still logon as the same user twice did I miss something

[webman]

Make sure the network folder exists as specified in the .VBS files (currently set as \\panther\disk2\logon) and that users have write access to this to create the token.

[edie209]

Hi webman, I think I have done all that but i'm at home now so I will check in the morning.