Disabling mutiple user logons

[nicolasgreening]

Is it possible to disable users from logging in to mutiple pc's in the domain?

We would like to be able to do this with Group policy so it cab be applied at the OU's.

Many Thanks

Nick

 

[Stevehewitt]

I don't believe that there is a specific way to do what you are asking.

If you are running NetBIOS on your network then I know that there is an option in the user account to say that the user can only logon to a specific PC.

I've cheated - their home drive (includes profile settings such as desktop, My Docs, systems settings etc.) is shared individually - with a maximum of 1 connection.

We use ScriptLogic, which if it can't access the home directory will refuse logon. In a non-ScriptLogic enviroment (where you are just using Group Policies) then Windows would still allow logon, but refuse access to the desktop etc.

Maybe if you were to do this, but create a WSH Script, where when the user logs on it runs. The script tried to access a system file or something - but if the script can't (due to max connections) then it will log the user off automatically?!

Steve.

 

[nicolasgreening]

Steve,

Unfortunatly we have not got scriptlogic and I cant see this being justification in itself.


Although this is microsoft and I cant find an answer. I cant beleive that there is not a policy or something simple to stop a user logging in to the domain on 2 pc's simontaniously, this must be a huge security risk.

Nick

 

[Stevehewitt]

I know what you mean, but why would you need to restrict it?

If you use set up their home folders as I mentioned above, and use Group Policies to run a script at logon that checks to see if it can access a hidden system file in their home drive. If the script can't find it and the clients are on XP you can just invoke the Shutdown.exe command and log them back off - effectivly stopping multiple logons.

Steve.