Limit user login times / locations using Advanced Server

Ok, I am really new to Advanced Server and find it very overwhelming at times.

Here is what I want to do. Can it be done?

Limit user access to specific IP addresses
Limit user access to the hours of 8am - 5pm

Is that posible?

The users are on our internal network. I have been dropped into this network with little preperation so any help would be valued.

*** If the answer is "this is not posible" or such, don't answer this question ***
Who is Participating?
dcgamesConnect With a Mentor Commented:
My comment was predicated on Win2K Active Directory and Domain Controller. Yes, if you want to have policies like these, you are better off using the full blown DC and AD features.

What leew talks about for individual users is what I was describing. However, you CAN set the same policies for a GROUP ("Users").

The problem with that is that it would apply to ALL users, which you probably don't want to do.

If you don't want to do individual users you are going to have to learn a LOT MORE about group policies than you would otherwise.

Regarding which machine a user can log in, I believe that if your machines are Win2K Professional, they are ALSO known to the domain controller and they can be managed just like users.

You can define policies for these machines, and you can specify which users can log in to which machines. But it is not done by IP but rather by Machine Name.

In Win2K, with DNS also based on the Active Directory, a machine named "JohnsPC" for example, would have a "FQDN" of "" (whatever your domain name may be). Machines have policies just like users.

If you REALLY want to learn about this, I can recommend some books. If you don't want to buy and read books I can provide a couple of links.

However, here is a good site that has lots of "hints" and "tips". Think of it as a Win2K Cheat-Sheet ..

"Wayne's Windows 2000 NT Resources for Administrators and Users" at

I found it useful enough that I sent him $25 bucks to support it. For example, I just searched for "Restrict Login" and found these tips:

1. Control number of workstations that a user can login simultaneously
2. Automatically logoff users who have restricted hours
3. Recover Lost Windows NT Administrator Password
4. Tips for NT Administrators

Didn't follow the links. Just doing a quich check.


Yes you can.

Group Policies takes care of this. But finding the right spot can be a chore.

First, consider that there are 3 levels of policies, each overriding the next one down. You probably want to setup this policies at the DOMAIN CONTROLLER level (the highest).

Anyway, I assume you are doing this on a domain controller and with Active Directory. If not, the approach is different.

Start by looking at the individual user profile. I think there is a spot where you specify the calendar that they can log on with.

Admin Tools / Manage Users & Computers/.. or something like that.

I don't recall these being difficult to find, but I don't have my Win2K Server here at work (it's at home), so I'll have to check there.

If no one else has the ready answer, I'll check tonight and post it tomorrow.

Lee W, MVPTechnology and Business Process AdvisorCommented:
So if the answer is "it's not possible" you don't want to know and would rather frustrate yourself as this question remained unanswered, uncertain if it was because it was impossible or because no one read the question...

Now, the later is definitely possible... the former is probably possible, but I don't have the answer for it.

The question is, what kind of domain do you have?  Windows 2000 Active Directory Domain or a Windows NT4 Domain.  If you have Windows NT Domain, then open user manager for Domains and click on the user you want to restrict.  Then click the "hours" button.  There you can select when the user can log on.

If 2000 Active Directory, open Active Directory Users and Computers, click the user's folder on the left hand side, then in the right pane, double-click the user you want to restrict.  Click the account tab on the window that appears and click the "Logon Hours" button.

As for restricting IPs, I don't think you can restrict specific IP Addresses, but you can restrict which computers a user can logon to.  In windows NT domains, you can limit this to 1-8 specific systems.  In Windows 2000, I haven't done it, but next to the "Logon Hours" button, you have a Log On To button.  It appears there may be no limit to the number of machines specified here.

Another way to limit users to specific machines is to go to each machine and change the local group accounts.  Set them to only allow specific groups instead of "Domain Users".
Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

Lee W, MVPTechnology and Business Process AdvisorCommented:
dcgames has what may be more of an elegant solution - mine is for specific users, but can be applied to all, just more tedious.
schworakAuthor Commented:
As we are just starting to migrate to Win2k from a very old Win for Workgroups network (ick!!!) this is all very new to me and I am trying to learn as I go. I know, that is the wrong way to do it but what can I do... No time to do it the right way around here.

We don't have active directory or domains setup yet, but since this may be the best way to control the access of the users, maybe I should do that first?

I can probably figure that out. It seemed rather strait forward when I was looking at it in the book. Well, the basics at least.

What do you think? Should I start over with domains instead of work groups?
schworakAuthor Commented:
Almost forgot...

This is a Win2k server but the clients are all Win98/Me
Lee W, MVPTechnology and Business Process AdvisorCommented:
If you are looking to control user access to systems, then I would certainly do domains over workgroups.  If that isn't an issue, then I would suggest the domain vs. workgroup issue depends on the number of machines you are using and the number of users you have - if more than 10-20, then definitely go domain.  

Domains provide centralized account management and because of 2000's security, you can run into some network connection problems if you combine 2000 and 98/ME clients without one.  (nothing unsolveable, just far more of a headache).

An NT4 domain is pretty easy to setup.  A 2000 domain has MUCH more to it and I would recommend you at least get some books on it, if not take a class.  You can get by without one, but you'll create far fewer headaches if you know what you are doing with Active Directory (AD).
schworakAuthor Commented:
Although I am not currently using domains, I plan on it in the near future. I hope redoing the computers isn't too much work.

Anyway, the information you have provided is more than enough to get me to where I want to go with this. I appreciate the help a great deal.

Thanks for the link too. That looks like a very good site.

One last question... Any good suggestions on books I should buy for learning Win2000 Domains and Active Directory?

I have a heavy work load and am still expected to get up to speed on this stuff. Darn small cheep shops... They don't want to send me to any training but want me to learn it all. (I know, I am whining...)
I found a great book from the "Mastering" series calles "Windows 2000 Advanced Server". It's a huge book but written in such a way that it's easy to read. I've found that I can read it even at night before going to bed.

I've got a few other books that are a lot more difficult to read. One is called "Active Direcotry", another is called "Windows 2000 Administration".

What I did is join the Library of Computer and Information Systems (LCIS). I got $150 worth of books on Win2K and had obligation to buy one mroe book over the course of a year at regular price. Easy sell.

Look here:

It's the Mark Minasi's Windows 2000 Resource Kit which includes the book I really like and a quite a few others for $9.95.


p.s. Didn't mean to plug LCIS. I don't work for them or anything. But if you decide to join them let me know cause I if you use my id they give you the same deal but I also get a free book for the referal.



schworakAuthor Commented:
Yeah, I think I will join. That sounds like a wonderful deal. EMail me your ID at and I will put it in when I sign up.
schworakAuthor Commented:
DCGAMES, do you by chance have the ISBN number of that book you are recommending? I am not finding it using the title.

Also, email me your ID number and I will see they give you that free book for refering me.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.