quick w2k sec question

[billb]

where do u set it so that a user can only log on at one pc at a time on a w2k3 network? ie they have to log off that pc before using another one?

Thanks

[_DeeJay_]

You can't set the number of concurrent logins in W2k3. There was a resource kit util which logged to a SQL DB IIRC, but it's not a supported product.

You can limit which machines a user can login to (i.e a single machine) is you like.

D

[billb]

yep the limiting to 1 machine at a time is what im after wheres this a group policy?

actually rereading this may not be what i'm after - i dont want a user logged into more than one machine at once?

Edited by billb on Wednesday 14th June 11:53

[_DeeJay_]

billb said:

yep the limiting to 1 machine at a time is what im after wheres this a group policy?

actually rereading this may not be what i'm after - i dont want a user logged into more than one machine at once?

Edited by billb on Wednesday 14th June 11:53

As I said, using the native tools IT CANNOT BE DONE.
I'm not sure why you'd want to either, really.

However, if you must - take a look at the windows 2000 resource kit tools. See here:www.microsoft.com/technet/archive/community/columns/questions/peeran14.mspx?mfr=true for info

D

[billb]

could have sworn u could do it but quick trawl of net shows ure right. want to do it as we're a school where everyone logs on everywhere and if we ban one user we dont want her asking her chum next door what her log in is and logging on as her ( yes they have been told they cant do this..!)

[_DeeJay_]

Yep, I suppose the usual threat to fire people who compromise security by giving out passwords won't work too well in your environment
I'd look at that tool, but it's a PITA to setup and use (and it's not really supported by MS).

The alternative is to write a logon script which records logins (or use something like MOM if you have it). From that you should be able to spot multiple logins.

D

[BliarOut]

You can do it with Novell

[_DeeJay_]

BliarOut said:

You can do it with Novell

Yep, you can. Should have mentioned that. Why not suggest they 'upgrade'?

[malman]

You could try this

www.microsoft.com/technet/technetmag/issues/2005/05/UtilitySpotlight/default.aspx

[agent006]

BODGE ALERT

Have a logon script that sets a file (in their userdrive?) to contain a 1 when they login. Set a logoff script that clears that to a 0. Said login script then has an IF statement, that if the file contains a 1 then goto a logoff command.

[malman]

thats the way i would do it

login script creates a file if it doesn't exist already otherwise logsoff

logout script deletes the file.


A clever kid will spot the login script and remove the file to allow his/her buddy in though.

Edited by malman on Wednesday 14th June 18:12

Edited by malman on Wednesday 14th June 18:12

[_Deejay_]

malman said:

thats the way i would do it

login script creates a file if it doesn't exist already otherwise logsoff

logout script deletes the file.


A clever kid will spot the login script and remove the file to allow his/her buddy in though.

Edited by malman on Wednesday 14th June 18:12

Edited by malman on Wednesday 14th June 18:12

Then a PC bluescreens and they cannot login any more.
Not the best idea, IMHO.

Or - clever kid just removes the network lead as they login, then adds it again afterwards.
The logon scripts will also be very visible (if they know where to look), and having worked in education they're devious little gits too!

Edited by _Deejay_ on Wednesday 14th June 20:09

Edited by _Deejay_ on Wednesday 14th June 20:14

[_Deejay_]

malman said:

You could try this

www.microsoft.com/technet/technetmag/issues/2005/05/UtilitySpotlight/default.aspx

Again, I'd like to see the logon.vbs code. What happens should it not be able to see the app partition at login?

D

[agent006]

_Deejay_ said:

Or - clever kid just removes the network lead as they login, then adds it again afterwards.

Not if you restrict the caching of logon details.

[_Deejay_]

agent006 said:

_Deejay_ said:

Or - clever kid just removes the network lead as they login, then adds it again afterwards.

Not if you restrict the caching of logon details.

Applying Personal Settings....click

For a foolproof solution, the domain controller would have to deny access based on the fact you were already logged in. Whilst that's not easy to do, you could do something by implementing the password filter DLL. I haven't looked at the API for a while, but IIRC, the username and password is passed to the code, so it could be done.

D

Edited by _Deejay_ on Wednesday 14th June 22:06

[agent006]

[_Deejay_]

agent006 said:

Sorry - what I meant to say was that wouldn't work; the machine will first validate you username and password, then update the screen saying 'Loading Personal Settings'. At that point, you could disconnect the network cable and it'd be unable to download the policies, so the logon script would not run.

In order to make this foolproof, you'd have to make the domain controller determine whether or not the user was logged in more than once. I'm not sure how you'd do that. However, one option would be to write a password filter DLL (passfilt.dll Google it) to perform the checks and deny logon. However, that would only be feasible if the passfilt.dll was given the username being processed as well as the password, and I can't remember whether it does or not.

D