StrataDecisionIT
asked on
Can I effectively disable a computer based on date/time?
In our company, the IT team manages a pool of "loaner" laptops. People tend to hang onto these computers forever once they've got their hands on them. These are domain computers. What are some options for rendering a computer unusable or "mostly useless" on a certain date, or after a specified time period (14 days or whatever)? I'm looking for a solution using Windows, but would be happy to hear of applications that do something like this.
ASKER
Thanks, Mahesh, but you've missed my objective. Allow me to restate it in the form of a scenario:
1. A user borrows a laptop computer from us on 1 March. He is supposed to return the computer to us on 15 March.
2. The user may or may not use the computer to connect to the domain via VPN.
3. On 16 March, the user still has the laptop at his home.
I would like for him to be unable to log into the computer at this point. Or, maybe he logs in and sees a message that all network connections have been disabled. In any case, something happens to render the computer essentially useless.
Thanks,
Shawn
1. A user borrows a laptop computer from us on 1 March. He is supposed to return the computer to us on 15 March.
2. The user may or may not use the computer to connect to the domain via VPN.
3. On 16 March, the user still has the laptop at his home.
I would like for him to be unable to log into the computer at this point. Or, maybe he logs in and sees a message that all network connections have been disabled. In any case, something happens to render the computer essentially useless.
Thanks,
Shawn
Ok
Technically you cannot control this type of restriction through computer accounts
U could do that by putting restrictions on user account as this is the only way I can see.
Because Computer account in AD never ever get idea that the physical laptop associated with that account gone to home along with user and it need to be disabled \ restricted after 15 days
For Ex:
User borrow laptop today.
You need to set user account properties in AD so that it will be expired after 15 days from the date of issuance of laptop
if user try to access \ logon with his account on 16th day, he can't
In that case he must come to office with laptop and submit the same and you could make his account non expiring
OR
Simplest way to do this, on 16th day you could disable his user account
Mahesh
Technically you cannot control this type of restriction through computer accounts
U could do that by putting restrictions on user account as this is the only way I can see.
Because Computer account in AD never ever get idea that the physical laptop associated with that account gone to home along with user and it need to be disabled \ restricted after 15 days
For Ex:
User borrow laptop today.
You need to set user account properties in AD so that it will be expired after 15 days from the date of issuance of laptop
if user try to access \ logon with his account on 16th day, he can't
In that case he must come to office with laptop and submit the same and you could make his account non expiring
OR
Simplest way to do this, on 16th day you could disable his user account
Mahesh
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
YES, that's what I was looking for--the scheduled task to disable the network interfaces. Great idea!
dsquery computer -inactive 4 -limit 0 > C:\inactiveComps.txt
Then check the list of computers from output and if ok then run below command to disable them as well
dsquery computer -inactive 4 -limit 0 | dsmod computer -disabled yes
4 represents four weeks of inactivity
http://www.servercare.nl/Lists/Posts/Post.aspx?ID=77
Mahesh