disabling an account whilst logged in

pma111
pma111 used Ask the Experts™
on
What happens in AD if you disable a users account whilst they are logged into the domain on a PC at that time? Does it log them off, or cant you diasble an account whilst someone is logged in? Just wondered from the users side what happens. Ie if I was the user logged into the domain on my PC, and you the AD admin disable my account, what happens?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®

Author

Commented:
Also are there any limitations on how many concurrent logins a user can have into a domain at once? i.e. could if I wanted I login to the domain on 30 PC's at a time, or does/could something in AD prevent this.
If someone has logged into the domain and the accoutn is disabled on at the same time, then user account will be logged in , but he will not be able to access any of the shared folder.
He will not be able to access any of the Directory services.

Regards,

_Prashant_
Krzysztof PytkoSenior Active Directory Engineer
Top Expert 2012
Commented:
Yes, you can disable user account whilst he/she is logged on. There is no limitation in domain to how many concurrent connections that user can have. There is also no built-in mechanism to prevent that :)

When you disable user account, after some time when kerberos TGT would be updated client will have error messages with info that access to resources is not possible,

Mostly, this user will contact to helpdesk or administrator to ask what's wrong with the account. And when you disable user's account it is not automatically log off

Regards,
Krzysztof
Krzysztof PytkoSenior Active Directory Engineer
Top Expert 2012

Commented:
could if I wanted I login to the domain on 30 PC's at a time, or does/could something in AD prevent this.

NO, User can go ahead and logon to multiple systems. If  you want to prevent this then you have to define Logon to in USer accoutn properties.

ie. go to dsa.msc--->user account--->properties--->account--->logon to --->define the computer accounts here.

After this user can only login to listed computer in logon to tab

Regards,

_Prashant_

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial