Stop Pupils Sharing their logins!

[chazzy2501]

How do I stop my users from logging in more than once at a time?

[plexer]

Microsoft had a tool and ad schema extension that did this.

 

Ben

[tmcd35]

Microsoft had a tool and ad schema extension that did this.

 

Ben

 

Limiting a user's concurrent connections in Windows Server 2003, Windows 2000, and Windows NT 4.0

[kennysarmy]

Share their Home drives just once?

 

Surely anyone found using another pupils account should be for the high jump?

 

Enough kids caught and punished and it will stop.....

 

BIG STICKS

[chazzy2501]

I did once put a limit on the homeshare to just 1 but you'll find that some machines hold the folder open even after they log out!

 

This caused a headache!

[srochford]

it's also a problem if a machine crashes and the user needs to logon to another machine (or possibly even the same machine!)

 

It's another problem where you can look for technical solutions but it's really a people problem so it needs a people solution.

[FN-GM]

We use Userlock - UserLock: Access security and control for Windows networks

[JJonas]

We did it this way for free

 

Prevent Multiple Logons With GPOs

[chazzy2501]

Does anyone here use Limit Login then?

 

I have to install a client to every machine in the network! And install something into the DC?

 

I suprised this isn't just a policy option!?

[plexer]

LimitLogin was what I was thinking of.

 

Utility Spotlight: Limit Login Attempts With LimitLogin

 

Ben

[srochford]

Do you record who logs on where? If not, why not - it's really useful to have that info and you'll find loads of threads here with info on how to do it.

 

Once you've got that, collect the info and parse it every day to find any user who was logged on to more than 2 machines at the same time. Pass that info to form teacher, head of year, whatever and get them to deal with it.

 

You can spend a long time trying to find ways to do this; none of them is perfect, all of them will cause grief in various ways (not least the bullying that will be triggered as kids who "need" another logon will beat up a weaker child to get their logon details)

[FAA]

LimitLogin is cumbersome to set up and use:

 

- For one thing, it performs an irreversible Active Directory Schema modification (!).

 

- For another, it creates a new partition in Active Directory. It also requires configuring a Web server with the .NET Framework and ASP.NET and setting it up to perform delegated Kerberos authentication.

 

- Finally, it requires distributing client packages that support communicating with the Web server via SOAP.

 

In short, a Rube Goldberg-ish piece of software ...

 

 

UserLock has just been reviewed in PC Mag and I cannot resist the pleasure of quoting 2 extracts from this review:

 

- "BOTTOM LINE: it’s an impressive product"

- "Overall, UserLock is a solid tool that any Windows Network Administrator should consider adding to their network management toolkit if tight user access control is mandatory for their organization."

 

Additionally, UserLock offers specific features to secure and optimize free access networks.

[srochford]

It's also $10.50 "per user session" according to the review you've quoted - that's quite a lot of money for most schools (see elsewhere the "no money for next year" thread.

[danrhodes]

It's also $10.50 "per user session" according to the review you've quoted - that's quite a lot of money for most schools (see elsewhere the "no money for next year" thread.

 

So if you have 1,200 students then thats going to work out at like $12,600 that's £8,247.18 at the current exchange rate, that's more than some peoples budgets for the year.

 

XE.com: USD to GBP rate: 12,600.00 USD = 8,251.25 GBP

 

D

[chazzy2501]

I don't want the faf of installing limit login!

 

 

I see the tool isn't supported in 2008? Does Server 2008 have this built in? if so, it might the rasin (yum) I've been looking for.

Edited March 18, 2010 by chazzy2501

[FAA]

Dear Steve,

 

Please find here UserLock detailed licensing and pricing.

 

As you will see, the price goes down as the amount of user session licenses purchased goes up, and for 1,000 licenses, public unit price amounts to EUR 2.80 / USD 3.84 (app GPB 2.50).

UserLock’s licensing scheme is per maximum simultaneous sessions on your network. This usually amounts to the total workstations, and NOT the total number of users.

 

 

More, IS Decisions offers a 20% discount to academic and educational organizations and is ready to thoroughly consider any kind of special bid.

 

Please feel free to directly contact IS Decisions: [email protected] to get a personalized quote.

 

Warm regards,

François

Edited March 18, 2010 by FAA

[chazzy2501]

I was on the user lock website and bought 515 licences the quote was $2,338.10 or £1532.34 this a per workstation price with 1 year of updates.

 

Still I can't believe this feature isn't built into active directory!

[penfold]

Do you record who logs on where? If not, why not - it's really useful to have that info and you'll find loads of threads here with info on how to do it.

 

Once you've got that, collect the info and parse it every day to find any user who was logged on to more than 2 machines at the same time. Pass that info to form teacher, head of year, whatever and get them to deal with it.

 

You can spend a long time trying to find ways to do this; none of them is perfect, all of them will cause grief in various ways (not least the bullying that will be triggered as kids who "need" another logon will beat up a weaker child to get their logon details)

 

I did this with the Limit Logon script from here. It logged the computer and user logons so you could see everytime each user/computer was used. It creates a temp file when a user logs on and deletes it when logging off. When a users logs on, it checks for the file and if it exists logs them off again. Do a seach and you should find it(or someone else will link it)

 

It was especially useful to eliminate errors caused by the user. We used to have a number of pupils who would just turn the power off to the computer and then wouldn't be able to log back on. Of course if you asked them, they never did it, but once you know thats what happens, you can provide the information to the teacher to *try and ensure they log on and off properly.

[FAA]

You can indeed develop logon scripts allowing to enforce single logon however these scripts are based on a hidden share in which logon scripts create and delete files.

 

This is a very dangerous solution because scripts run as logged on users, and all users therefore need full access to the hidden share.

 

Once a rogue user has understood how it works and were the hidden share is located (path can easily be retrieved from the user registry), he/she can remove its own session, kill the whole session database or add sessions that don’t exist to other users as a (bad) joke.

 

Consequently, such a solution adds more potential security problems than it solves ...

[sted]

possibly not an ideal solution but i cant see why it wouldnt work

 

add to your logon script a check for say user area\loggedin.txt and if it find it run shutdown /l if it dosent find it create it (and hide it) and login as normal. then add a logout script that deletes it

 

quick and dirty but should work

and you could probably write a script to clear and files overnight incase of people just turning off pcs etc

[broc]

There is a facility in Impero that does this.... although licencing Impero for just this one feature would be expensive.....

[featured_spectre]

All logins are limited to 1 session at a time. The only exception to this is the generic staff and pupil login for the ICT suite where it is limited to 10.

 

This is done via GPO for the user accounts on Server 2008 R2

[Gountz]

This is done via GPO for the user accounts on Server 2008 R2

 

Interesting.

How did you do via GPO? I don't find the one doing that. I only find the TS restriction.

[tmcd35]

 

This is done via GPO for the user accounts on Server 2008 R2

 

Probably being bline but I couldn't see anything in GPO's. Does the domain need to be at 2008R2 function level for this to appear?

[ricki]

hi

 

I have seen it done with a script at logon that checks for a folder created in a share. If it find it it logs off. If it does not find it it creates it creates a folder with the username and does nothing else. On log off it deleted the folder.

 

i have looked all over for the scipts but cannot find them sorry.

 

Richard