Limit user login times / locations using Advanced Server

Yes you can.

Group Policies takes care of this. But finding the right spot can be a chore.

First, consider that there are 3 levels of policies, each overriding the next one down. You probably want to setup this policies at the DOMAIN CONTROLLER level (the highest).

Anyway, I assume you are doing this on a domain controller and with Active Directory. If not, the approach is different.

Start by looking at the individual user profile. I think there is a spot where you specify the calendar that they can log on with.

Admin Tools / Manage Users & Computers/.. or something like that.

I don't recall these being difficult to find, but I don't have my Win2K Server here at work (it's at home), so I'll have to check there.

If no one else has the ready answer, I'll check tonight and post it tomorrow.

Dave

So if the answer is "it's not possible" you don't want to know and would rather frustrate yourself as this question remained unanswered, uncertain if it was because it was impossible or because no one read the question...

Now, the later is definitely possible... the former is probably possible, but I don't have the answer for it.

The question is, what kind of domain do you have?  Windows 2000 Active Directory Domain or a Windows NT4 Domain.  If you have Windows NT Domain, then open user manager for Domains and click on the user you want to restrict.  Then click the "hours" button.  There you can select when the user can log on.

If 2000 Active Directory, open Active Directory Users and Computers, click the user's folder on the left hand side, then in the right pane, double-click the user you want to restrict.  Click the account tab on the window that appears and click the "Logon Hours" button.

As for restricting IPs, I don't think you can restrict specific IP Addresses, but you can restrict which computers a user can logon to.  In windows NT domains, you can limit this to 1-8 specific systems.  In Windows 2000, I haven't done it, but next to the "Logon Hours" button, you have a Log On To button.  It appears there may be no limit to the number of machines specified here.

Another way to limit users to specific machines is to go to each machine and change the local group accounts.  Set them to only allow specific groups instead of "Domain Users".

dcgames has what may be more of an elegant solution - mine is for specific users, but can be applied to all, just more tedious.

As we are just starting to migrate to Win2k from a very old Win for Workgroups network (ick!!!) this is all very new to me and I am trying to learn as I go. I know, that is the wrong way to do it but what can I do... No time to do it the right way around here.

We don't have active directory or domains setup yet, but since this may be the best way to control the access of the users, maybe I should do that first?

I can probably figure that out. It seemed rather strait forward when I was looking at it in the book. Well, the basics at least.

What do you think? Should I start over with domains instead of work groups?

Almost forgot...

This is a Win2k server but the clients are all Win98/Me

If you are looking to control user access to systems, then I would certainly do domains over workgroups.  If that isn't an issue, then I would suggest the domain vs. workgroup issue depends on the number of machines you are using and the number of users you have - if more than 10-20, then definitely go domain.  

Domains provide centralized account management and because of 2000's security, you can run into some network connection problems if you combine 2000 and 98/ME clients without one.  (nothing unsolveable, just far more of a headache).

An NT4 domain is pretty easy to setup.  A 2000 domain has MUCH more to it and I would recommend you at least get some books on it, if not take a class.  You can get by without one, but you'll create far fewer headaches if you know what you are doing with Active Directory (AD).

Although I am not currently using domains, I plan on it in the near future. I hope redoing the computers isn't too much work.

Anyway, the information you have provided is more than enough to get me to where I want to go with this. I appreciate the help a great deal.

Thanks for the link too. That looks like a very good site.

One last question... Any good suggestions on books I should buy for learning Win2000 Domains and Active Directory?

I have a heavy work load and am still expected to get up to speed on this stuff. Darn small cheep shops... They don't want to send me to any training but want me to learn it all. (I know, I am whining...)

I found a great book from the "Mastering" series calles "Windows 2000 Advanced Server". It's a huge book but written in such a way that it's easy to read. I've found that I can read it even at night before going to bed.

I've got a few other books that are a lot more difficult to read. One is called "Active Direcotry", another is called "Windows 2000 Administration".

What I did is join the Library of Computer and Information Systems (LCIS). I got $150 worth of books on Win2K and had obligation to buy one mroe book over the course of a year at regular price. Easy sell.

Look here:
http://lcis.booksonline.com/cgi-bin/ndCGI.exe/Develop/pagHome?clubId=LCI

It's the Mark Minasi's Windows 2000 Resource Kit which includes the book I really like and a quite a few others for $9.95.

Dave

p.s. Didn't mean to plug LCIS. I don't work for them or anything. But if you decide to join them let me know cause I if you use my id they give you the same deal but I also get a free book for the referal.

:)

Dave

Yeah, I think I will join. That sounds like a wonderful deal. EMail me your ID at glenn@g-world.com and I will put it in when I sign up.

DCGAMES, do you by chance have the ISBN number of that book you are recommending? I am not finding it using the title.

Also, email me your ID number and I will see they give you that free book for refering me.