Control Login Time

[Innocent Devil]

I want to limit the login time of specific users t o fix between some periods only

eg: a user, say Mike can only login between 8:00AM to 8:00PM y and not allowd to login on sundays

it is 2b implemeted ona stadalone workstation

OS can be 2k,XP or 2k3

[KAndle]

I believe it would have to be on 2003 which is a server & not really a standalone workstation. As far as I know those options are only available on 2000/2003 Server. I think it has to be a domain controller as well to see those options through the management console. My 2000 pro doesn't show them.

Edited October 3, 2005 by KAndle

[Shotgun]

Actually...

Windows 2000 Administrators have an option in the Active Directory Users & Computers GUI to limit the user's logon hours, local administrators (Windows 2000 Workstation) do not have that option in the Local Users and Groups console.

In order to do that you'll need to use the NET USER command.

Some examples would be:

net user sonny /time:S-F,08:00-18:00

net user sonny /time:S-F,8am-6pm

net user sonny /time:M,4am-4pm;T,1pm-3pm;W-F,8:00-16:00

net user sonny /time:all

Open a Command Prompt window.

Enter the appropriate "net user" command for the user(s) you wish to restrict access for. Local users can't be forced off when logon hours expire.

I may be mistaken, but I think this works from NT and up (NT, 2000, XP, 2003).

[HyperHacker]

Local users can't be forced off when logon hours expire.

<{POST_SNAPBACK}>

But you could use the At utility to run 'shutdown -l' at the desired time. Gotta be careful with this, though. I think the process can be cancelled; say if you opened a Notepad window, wrote something and didn't save it, if you click Cancel when it asks to save, it won't log you off. (This happens with shutdown, but I didn't try log off.) And of course if you force it, people could lose their work. Also you can specify a timeout and message, but this gives users the opportunity to abort it by running 'shutdown -a'.

[Shotgun]

My users are restricted from running anything from a command prompt. You may also restrict the security permissions of the shutdown.exe file. That way they can't abort a shutdown.

UPDATE: Found a shareware app to help set them. Access Boss. I know there's a freeware for the same thing, I just can't seem to find it right now.

UPDATE: FOUND IT! Account View 100% freeware.

[ringfinger]

EDIT: Didn't see standalone machine, advice N/A.

Edited October 3, 2005 by ringfinger

[Shotgun]

Just use 2000/2003 AD on your DC.  You can set logon times by user or by group/OU.

<{POST_SNAPBACK}>

check the 1st post. It is to be implemented on a standalone workstation, so no DC tools will be much help there.

[ringfinger]

Just use 2000/2003 AD on your DC.  You can set logon times by user or by group/OU.

<{POST_SNAPBACK}>

check the 1st post. It is to be implemented on a standalone workstation, so no DC tools will be much help there.

<{POST_SNAPBACK}>

Ooops sry...

[KAndle]

Windows 2003 will do what he wants if that is a viable option for him. That is what he wanted to know. Thanks for the info on the freeware but I would hesitate to use freeware to lock down my computer with confidence. If this is for his child then he might need to do better because I would figure out how to disable it. Like safe mode or something. I haven't tried them but how about a system restore back to a date before that was installed? He just has to make 2003 a Domain Controller with Active Directory. That should work fine for what he wants without additional software. Noone needs to have external access to it. Disable/Uninstall all the extra services & it should work fine.

Just my 2 cents.

[ringfinger]

KAndle... that's what I suggested as well before re-reading the post. He wants it on a standalone machine not joined to a network I'd presume, so AD isn't applicable.

[ripken204]

there is a program called 1st security administrator, it will do that plus a crap load more, but it will cost

http://www.softheap.com/secagent.html

and 1st security agent

http://www.softheap.com/newadmin.html

not to osure if there is a difference between them...

Edited October 4, 2005 by ripken204

[Takeshi]

Actually...

Windows 2000 Administrators have an option in the Active Directory Users & Computers GUI to limit the user's logon hours, local administrators (Windows 2000 Workstation) do not have that option in the Local Users and Groups console.

In order to do that you'll need to use the NET USER command.

Some examples would be:

net user sonny /time:S-F,08:00-18:00

net user sonny /time:S-F,8am-6pm

net user sonny /time:M,4am-4pm;T,1pm-3pm;W-F,8:00-16:00

net user sonny /time:all

Open a Command Prompt window.

Enter the appropriate "net user" command for the user(s) you wish to restrict access for. Local users can't be forced off when logon hours expire.

I may be mistaken, but I think this works from NT and up (NT, 2000, XP, 2003).

<{POST_SNAPBACK}>

In XP there is certainly the Net User command available.

And in secpol.msc, under:

Security Settings > Local Policies > Security Options >

Network security: Force logoff when logon hours expire

Won't this work for a standalone workstation?

[Shotgun]

... Thanks for the info on the freeware but I would hesitate to use freeware to lock down my computer with confidence. ...

The freeware justs makes it easier to change the options that the command line tools modify. It does not alter your system, makes the same changes you would do with the command line tools.