Prevent computer access w/o server authentication 1

[randybreck]

I have a problem. I have time restrictions set at my windows 2000 server on certain profiles. Everything is working fine, but this does not prevent them from unplugging from the network and logging into the computer (running XP).

I would like to restrict them from accessing the computer when their time restriction is up. I do not have a proxy server running yet, so I have my server acting as a router. Users are able to logon to the computer while unplugged from the network (to avoid the time restriction) then plug back in and surf the net through the server as a router. Any help on how I can restrict them from logging into the computer while it is disconnected from the server?

 

[imatthec]

If the users have NO local account on the machines they're accessing from, then they should not be able to logon at will.

 

[randybreck]

They do not have a local account, however they do have an account on the domain. I noticed that when they log onto the domain their roaming profiles are stored locally in a folder in the documents and setting folder. If I delete that then they will not be able to log in without the server. As soon as they log onto the server the roaming profile is again created locally. I could just delete this temporary file every day after their time is up, but what a pain. Hopefully there is a way to have the computer remove the local profile when they log out.

 

[brontosaurus]

Group Policy\Computer Configuration\Administrative Templates\System\Logon\Delete cached copies of roaming profiles.

 

[randybreck]

Thanks for the info. I just started learning about Group Policy and this will surely help