rpettit Posted March 21, 2011 Posted March 21, 2011 As a school we have a laptop scheme were students can purchase a laptop on a 3 year period. Students can login to these on the domain and their own restircted local accounts. Laptops are taken to and from school on a daily basis and used in lessons and at home. The laptops are connected to the schools wireless network. The laptops are running a range of OS from XP to Windows 7. How can we restrict laptops so they cannot login during specified hours of the days? This restriction will then need to be moved or changed when a holiday period starts.
FN-GM Posted March 21, 2011 Posted March 21, 2011 As a school we have a laptop scheme were students can purchase a laptop on a 3 year period. Students can login to these on the domain and their own restircted local accounts. Laptops are taken to and from school on a daily basis and used in lessons and at home. The laptops are connected to the schools wireless network. The laptops are running a range of OS from XP to Windows 7. How can we restrict laptops so they cannot login during specified hours of the days? This restriction will then need to be moved or changed when a holiday period starts. Are we talking about the local accounts or network accounts being restricted? I assume you mean local?
rpettit Posted March 21, 2011 Author Posted March 21, 2011 Yes. Restrict the local account. The local account needs to be restricted during school hours but avaliable during holiday periods and after school.
FN-GM Posted March 21, 2011 Posted March 21, 2011 The only way i can think of it some kind of script. Alternatively do away with local accounts and used cached credentials so they can use a domain account at home.
Steve21 Posted March 21, 2011 Posted March 21, 2011 Can you not just use "net user" time logins? Net User "account" /time:m-f,09:00-15:00 etc. If I remember correctly it'll only disable login at that time, not log someone out. So you'd have to make a logout script too if you want to ensure no-ones already logged in locally before 9am or whatever. *Edit - And it's something like: net user "account" /time:all to reenable all time login for holidays etc Any use? Steve
rpettit Posted March 21, 2011 Author Posted March 21, 2011 Thats great help Steve. Each local account has a different user name. How would this be scripted?
Steve21 Posted March 21, 2011 Posted March 21, 2011 Is there any logical naming method? or is it just every user creates their own random login? Steve
rpettit Posted March 21, 2011 Author Posted March 21, 2011 The naming method is that their domain username is the same as their local username.
sted Posted March 21, 2011 Posted March 21, 2011 could you get the script to run at logon using %username% ?
rpettit Posted March 21, 2011 Author Posted March 21, 2011 If I created the script Net User %USERNAME% /time:m-f,09:00-15:00 this could work. Think testing is in order!! I could create this as a login script and then a few days before a holiday I could run Net User %USERNAME% /time:all
FN-GM Posted March 21, 2011 Posted March 21, 2011 How would you get round this not to be in action during the holidays?
sted Posted March 21, 2011 Posted March 21, 2011 How would you get round this not to be in action during the holidays? a batch file that at startup copies the latest version of the script from the sever to the allusers startup folder?
Steve21 Posted March 21, 2011 Posted March 21, 2011 Yeah few ways of doing it I guess But not sure either way will be "Perfect" as such, as obviously the dates will be changing all the time. Guessing even days like teacher training you'd want it disabled really. Guess other option is running a script which will check some reference (file on webserver etc) to check if it's "holiday" or not etc. But again, obvious flaw is if they're not online (and/or someone forgot to update it ) etc etc. But yeah, shout back when you tested it and see how it goes Steve
rpettit Posted March 21, 2011 Author Posted March 21, 2011 The command - Net User %USERNAME% /time:m-f,09:00-15:00 works, but sets 09:00-15:00 as the allowed login time...Is there a way to set this as the disallowed login time?
Steve21 Posted March 21, 2011 Posted March 21, 2011 The command - Net User %USERNAME% /time:m-f,09:00-15:00 works, but sets 09:00-15:00 as the allowed login time...Is there a way to set this as the disallowed login time? Silly idea, but try 15:00-09:00? Not sure if it'll emo a bit as it's over 2 days effectively, but worth trying. If not should be able to do it like, Net User %USERNAME% /time:m-f,00:00-09:00;m-f,15:00-24:00 But never actually tried dual times Steve
rpettit Posted March 21, 2011 Author Posted March 21, 2011 Steve Tested and works great. Looking to run this script when the user logs into their laptop. Assuming the GP would be a user configuration --> log on script on the machine? Or would this be on the user?
rpettit Posted March 21, 2011 Author Posted March 21, 2011 That works a treat. Having to use dual times and the 15:00-09:00 works. What is the best way to deploy? It needs evelated permissions to run on Windows 7 and Vista.
Steve21 Posted March 21, 2011 Posted March 21, 2011 What you running it as? BAT? Or login script? Or? Steve
rpettit Posted March 21, 2011 Author Posted March 21, 2011 Running as a batch file. I could add it to the login script that maps the network drives.
Steve21 Posted March 21, 2011 Posted March 21, 2011 Aye, Other options are using "run as" but if they manage to find the file it'd have the admin login/password for the pc, and/or rewriting it to vbsript, Don't think UAC blocks them. Guess login script is easiest. Not sure if there's many other ways, still newish to GPs Steve
rpettit Posted March 21, 2011 Author Posted March 21, 2011 How would I add the run as into the batch with an account with elevated privledges
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now