Prevent multiple logins

[Sheridan]

Our Macs are setup with the usual golden triangle logins.One thing I would like to do but haven't found a way to yet, is to stop users logging on to more than Mac at a time.

 

I know theres an option in WGM where you can uncheck 'Allow simultaneous login on managed computers' but I'd have to do this for all of our users indivudually when I would ideally like to do it by group.

 

Is there anyway of doing this? I did it with our windows machines using scripts but I'm not sure how to go about that with the macs.

[HodgeHi]

If these are windows users then I'm not sure how you would do this for each user anyway as it won't be able to save the setting. After checking my my account just after refreshing the changes made, the the checkbox is just re-ticked.

 

If you are changing the setting for OD users you should be able to select multiple users and then toggling the setting like that.

 

In theory if the setting is just a plist file you may be able to push it out via WGM as a managed preference. Seeing as it is in the accounts section though, this may not be possible.

[Sheridan]

Yes these are AD users organised into OD groups for deploying preferences.

 

I can see the setting at a user level. I didn't realise it would reset so maybe this is a non-starter

[HodgeHi]

There may be other ways. A defaults write a plist file/augmented record. The info may sit in the Schema though which would be the reason the info is reset afterwards on refresh. A possible AD schema extension (if you can find the right bit to hold this data) may be possible too?

[Sheridan]

The only other way I was thinking was if the user ran a login script which created/checked for a file in their home folder. If the file exists, log them off otherwise create it. I haven't got a clue how to do that in osx, but its roughly what I did for the windows PCs

[iSteve]

I don't think you can do this. We had it running when we were running Open Directory, as that did the authentication and you ticked the box in WGM and it just worked. Since we moved to AD you have the Windows machine doing the authentication things start to get....well, they don't work.

 

You could create a login hook that creates or copies a file called 'user' in their home folder. If that file already exists it logs the user out. You'd then have a logout hook that rm's the file on clean log out. However this will be annoying of the machine crashes and there isn't a clean log out for the user as it won't let them log in at all (similar to Firefox not exiting properly!).