Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have discovered that users in my Active Directory domain can log in to their account many times parallely. I mean for example 2 machines and on each login to the same account.

Is it good? I see security concern in this way of maintaining user sessions because if someone will know password of the user then right user of account even doesn't know that someone has logged into his account. Local login wouldn't let second user log in without prompt to logout user and I think it is a good mechanism. Another thing is that work of 2 on the same account can lead to loss data saving changes to 1 synchronized file(AD).

I am trying to solve what is better: block (any way) ability to log in more than 1 time to AD account or let it be as it is for convinience reason.

share|improve this question
    
possible duplicate of One AD user Multiple Logins –  jscott May 26 '11 at 14:09

2 Answers 2

It really depends on your situation. We do let most users have more than 1 login available, in case they move from one desk to another and only need to do a quick login somewhere else. The applications that they might use may enforce a single login, but our AD is not so strict.

If, however, you are using 1 login for multiple users, that's a definite security no-no. Each user should be associated to his or her own account.

share|improve this answer
    
I thought about scenario for example where user account has compromised and even doesn't know if someone log in to his own account. –  skomak May 29 '11 at 9:46

It is mostly harmless. Possible problems using parallel logins may arise if your users use roaming profiles or folder redirection to network shares.

There are means to restrict the ability for parallel logins:

  • LimitLogin is a Sysinternals tool with an own login database and nice AD/MMC integraton
  • set up a logon script checking on possible parallel logins and logging the user off again if this is the case

All methods have the disadvantage of being client-initiated in the logged on user's context - the user can simply abort the script / logoff request execution to prevent being logged off again.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.