Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Has anyone found a good way within Active Directory or Group Policy in order to prevent users from logging into multiple workstations simultaneously?

As a bit of background, I currently am a System admin for a state business that has multiple sites with users that work with unassigned workstations. In order to accommodate the needs of the users we have implemented roaming profiles, and to prevent too much transfer of profile data we also redirect certain aspects of their profile. (Most notably their My Documents folder.)

Unfortunately we often have users logging into multiple workstation at a time, sometimes upwards of three or four workstations at a time, and as a result we have had some profile corruption as a result of improper logoffs/shutdowns and the like.

Right now we do not have any budget for third party tools to manage this issue, so I was hoping to find a solution within Group Policy, or a setting in a user's profile in Active Directory I could use.

share|improve this question
up vote 1 down vote accepted

Microsoft have the LimitLogon Utility that can be used to help with this problem, it can be downloaded from here. For full details on this process, see this article. This article talks about NT4 and 2000 however it says it also applies to 2003.

share|improve this answer
Zow! That tool creates a custom AD partition... That's a little scary. Also, its "client" only runs at logon and logoff (rather that periodically during a user's session) so you could have a problem with having to clear "stale" user connections if a user improperly restarts a PC w/o logging-off. I think I'd test this thing in a testing AD forest before I'd put it into my production AD forest. – Evan Anderson Aug 8 '09 at 0:23
Yeah, I'd agree you defiantly want to teat something like this extensively before use, prob should have said that! – Sam Aug 8 '09 at 8:41

From what I understand this really isn't possible. I've only ever seen Novell be the ones to have this feature. Is this honestly something that you're having trouble with, or just curious about? You'd be better off going with a logoff screensaver. You can find this in the 2003 Resource kit.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.