Solved

Limit user login times / locations using Advanced Server

Posted on 2001-07-11
11
957 Views
Last Modified: 2010-04-13
Ok, I am really new to Advanced Server and find it very overwhelming at times.

Here is what I want to do. Can it be done?


Limit user access to specific IP addresses
Limit user access to the hours of 8am - 5pm


Is that posible?

The users are on our internal network. I have been dropped into this network with little preperation so any help would be valued.


*** If the answer is "this is not posible" or such, don't answer this question ***
0
Comment
Question by:schworak
  • 5
  • 3
  • 3
11 Comments
 
LVL 5

Expert Comment

by:dcgames
ID: 6273491
Yes you can.

Group Policies takes care of this. But finding the right spot can be a chore.

First, consider that there are 3 levels of policies, each overriding the next one down. You probably want to setup this policies at the DOMAIN CONTROLLER level (the highest).

Anyway, I assume you are doing this on a domain controller and with Active Directory. If not, the approach is different.

Start by looking at the individual user profile. I think there is a spot where you specify the calendar that they can log on with.

Admin Tools / Manage Users & Computers/.. or something like that.

I don't recall these being difficult to find, but I don't have my Win2K Server here at work (it's at home), so I'll have to check there.

If no one else has the ready answer, I'll check tonight and post it tomorrow.

Dave
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 6273574
So if the answer is "it's not possible" you don't want to know and would rather frustrate yourself as this question remained unanswered, uncertain if it was because it was impossible or because no one read the question...

Now, the later is definitely possible... the former is probably possible, but I don't have the answer for it.

The question is, what kind of domain do you have?  Windows 2000 Active Directory Domain or a Windows NT4 Domain.  If you have Windows NT Domain, then open user manager for Domains and click on the user you want to restrict.  Then click the "hours" button.  There you can select when the user can log on.

If 2000 Active Directory, open Active Directory Users and Computers, click the user's folder on the left hand side, then in the right pane, double-click the user you want to restrict.  Click the account tab on the window that appears and click the "Logon Hours" button.

As for restricting IPs, I don't think you can restrict specific IP Addresses, but you can restrict which computers a user can logon to.  In windows NT domains, you can limit this to 1-8 specific systems.  In Windows 2000, I haven't done it, but next to the "Logon Hours" button, you have a Log On To button.  It appears there may be no limit to the number of machines specified here.

Another way to limit users to specific machines is to go to each machine and change the local group accounts.  Set them to only allow specific groups instead of "Domain Users".
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 6273585
dcgames has what may be more of an elegant solution - mine is for specific users, but can be applied to all, just more tedious.
0
 
LVL 3

Author Comment

by:schworak
ID: 6273589
As we are just starting to migrate to Win2k from a very old Win for Workgroups network (ick!!!) this is all very new to me and I am trying to learn as I go. I know, that is the wrong way to do it but what can I do... No time to do it the right way around here.

We don't have active directory or domains setup yet, but since this may be the best way to control the access of the users, maybe I should do that first?

I can probably figure that out. It seemed rather strait forward when I was looking at it in the book. Well, the basics at least.

What do you think? Should I start over with domains instead of work groups?
0
 
LVL 3

Author Comment

by:schworak
ID: 6273592
Almost forgot...

This is a Win2k server but the clients are all Win98/Me
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 6273620
If you are looking to control user access to systems, then I would certainly do domains over workgroups.  If that isn't an issue, then I would suggest the domain vs. workgroup issue depends on the number of machines you are using and the number of users you have - if more than 10-20, then definitely go domain.  

Domains provide centralized account management and because of 2000's security, you can run into some network connection problems if you combine 2000 and 98/ME clients without one.  (nothing unsolveable, just far more of a headache).

An NT4 domain is pretty easy to setup.  A 2000 domain has MUCH more to it and I would recommend you at least get some books on it, if not take a class.  You can get by without one, but you'll create far fewer headaches if you know what you are doing with Active Directory (AD).
0
 
LVL 5

Accepted Solution

by:
dcgames earned 100 total points
ID: 6273789
My comment was predicated on Win2K Active Directory and Domain Controller. Yes, if you want to have policies like these, you are better off using the full blown DC and AD features.

What leew talks about for individual users is what I was describing. However, you CAN set the same policies for a GROUP ("Users").

The problem with that is that it would apply to ALL users, which you probably don't want to do.

If you don't want to do individual users you are going to have to learn a LOT MORE about group policies than you would otherwise.

Regarding which machine a user can log in, I believe that if your machines are Win2K Professional, they are ALSO known to the domain controller and they can be managed just like users.

You can define policies for these machines, and you can specify which users can log in to which machines. But it is not done by IP but rather by Machine Name.

In Win2K, with DNS also based on the Active Directory, a machine named "JohnsPC" for example, would have a "FQDN" of "johnspc.domainname.com" (whatever your domain name may be). Machines have policies just like users.

If you REALLY want to learn about this, I can recommend some books. If you don't want to buy and read books I can provide a couple of links.

However, here is a good site that has lots of "hints" and "tips". Think of it as a Win2K Cheat-Sheet ..

"Wayne's Windows 2000 NT Resources for Administrators and Users" at http://is-it-true.org/nt/nt2000/index.shtml

I found it useful enough that I sent him $25 bucks to support it. For example, I just searched for "Restrict Login" and found these tips:

1. Control number of workstations that a user can login simultaneously
2. Automatically logoff users who have restricted hours
3. Recover Lost Windows NT Administrator Password
4. Tips for NT Administrators

Didn't follow the links. Just doing a quich check.

Dave


0
 
LVL 3

Author Comment

by:schworak
ID: 6273940
Although I am not currently using domains, I plan on it in the near future. I hope redoing the computers isn't too much work.

Anyway, the information you have provided is more than enough to get me to where I want to go with this. I appreciate the help a great deal.

Thanks for the link too. That looks like a very good site.

One last question... Any good suggestions on books I should buy for learning Win2000 Domains and Active Directory?

I have a heavy work load and am still expected to get up to speed on this stuff. Darn small cheep shops... They don't want to send me to any training but want me to learn it all. (I know, I am whining...)
0
 
LVL 5

Expert Comment

by:dcgames
ID: 6274255
I found a great book from the "Mastering" series calles "Windows 2000 Advanced Server". It's a huge book but written in such a way that it's easy to read. I've found that I can read it even at night before going to bed.

I've got a few other books that are a lot more difficult to read. One is called "Active Direcotry", another is called "Windows 2000 Administration".

What I did is join the Library of Computer and Information Systems (LCIS). I got $150 worth of books on Win2K and had obligation to buy one mroe book over the course of a year at regular price. Easy sell.

Look here:
http://lcis.booksonline.com/cgi-bin/ndCGI.exe/Develop/pagHome?clubId=LCI

It's the Mark Minasi's Windows 2000 Resource Kit which includes the book I really like and a quite a few others for $9.95.

Dave

p.s. Didn't mean to plug LCIS. I don't work for them or anything. But if you decide to join them let me know cause I if you use my id they give you the same deal but I also get a free book for the referal.

:)

Dave

0
 
LVL 3

Author Comment

by:schworak
ID: 6274295
Yeah, I think I will join. That sounds like a wonderful deal. EMail me your ID at glenn@g-world.com and I will put it in when I sign up.
0
 
LVL 3

Author Comment

by:schworak
ID: 6275734
DCGAMES, do you by chance have the ISBN number of that book you are recommending? I am not finding it using the title.

Also, email me your ID number and I will see they give you that free book for refering me.
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Is your company's data protection keeping pace with virtualization? Here are 7 dynamic ways to adapt to rapid breakthroughs in technology.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now