Limit the number of logins from an OU..?

[thatguy]

Hey all--

I just got a rather odd request from my boss. He wants to limit the number of logins from a particular OU. For instance, there may be 10 users in an OU, but he wants to make it so only 5 users from that OU can be logged in at any one time. (This is via Terminal Services by the way.)

Is this even remotely possible?

Thanks
--frank~

 

[MarkatLMFJ]

Ummm, hrmmmm......well, maybe write a script to run when users logon to your terminal server, check for all other logged in users, check their OU, and count them up and if X = Y = 3.14159 * n^sqrt(-2i)+1 then force their logout from the script?

MAL

 

[pgaliardo]

Only way I can think of is to assign this OU their own Terminal Server,only allow them to logon to that server, then limit the number of server connections to that server. That might work.

 

[thatguy]

Trouble is, we have 4 OUs that we'd need to set a limit on, so that'd make the hardware option rather pricey.

The script option sounds feasible. I'll just have to find a way to enumerate the users in an OU and check if they're logged in. Any thoughts on that one?

Thanks
-- frank~

 

[dberg35]

You can set login times for each user.

 

[thatguy]

Thanks for the thought, but this is an app hosting server. A client may have 10 user accounts in their OU, but will have only paid for 5 logins. So we'd like some way to limit them to 5 users logged in at any time. We've thought about just creating 5 general user accounts (user1, user2, user3, etc), but then there's no accountability; no way to track which user did something stupi-.. accidentally.

If there was a function somewhere that would enumerate the users in an OU, and another function to check whether or not a user account was logged in, this would be totally do-able. Anyone know of those functions? Anyone? Anyone?

Thanks
--frank~

 

[MarkatLMFJ]

> If there was a function somewhere that would
> enumerate the users in an OU, and another
> function to check whether or not a user account
> was logged in, this would be totally do-able. Anyone
> know of those functions? Anyone? Anyone

a command line dsquery command can find the users in an OU; you can also do it through most of the .NET languages.

Then you need to figure out how to check what users are logged into the machine, I'm sure theres an API out there to do this.

....and then you need to implement the lgoic......

.......and then you need to force the log out if necessary.

.........sounds a lot like my first post back to you (minus some of the humor). I'd suggest hiring a programmer with some active directory and server administration background and experience programming for such.

ML