Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We've got a Software restriction GPO setup and I was wondering if it was possible to make this only active during certain times.

For example, only make certain game executables available to use at lunch times.

Running Server 2012.

share|improve this question

2 Answers 2

up vote 6 down vote accepted

Not with any of the vanilla Windows tools, I'm afraid. This is where classroom management solutions (Tutor, Impero etc) come in,

share|improve this answer

yes it is possible with WMI filters however users would have to run manually gpupdate or wait for the policy to refresh. Remember that default refresh every 90 minutes by default, with a random offset of 0 to 30 minutes - take that into account. You can adjust this too.

source: http://blogs.technet.com/b/askds/archive/2008/09/11/fun-with-wmi-filters-in-group-policy.aspx

Only on a certain day of the week

Yes this is possible! Yes, customers have asked how to do this! No, I have no idea why! Ok, kidding about that last one, but it sure seems like an odd request at first. It turns out that some companies like to do things like set a specific message of the day for their legal notice. Or have a separate screensaver running every day of the week for their users. Different strokes for different folks, I suppose.

To do this, your WQL queries (one filter per GPO that you wanted to set, remember) would be:

Select DayOfWeek from Win32_LocalTime where DayOfWeek = 1

Select DayOfWeek from Win32_LocalTime where DayOfWeek = 2

Select DayOfWeek from Win32_LocalTime where DayOfWeek = 3

so if day of the week is possible then a specific time would also be possible and indeed it is : source: http://msdn.microsoft.com/en-us/library/aa394171%28v=vs.85%29.aspx

class Win32_LocalTime : Win32_CurrentTime

{
  uint32 Day;
  uint32 DayOfWeek;
  uint32 Hour;
  uint32 Milliseconds;
  uint32 Minute;
  uint32 Month;
  uint32 Quarter;
  uint32 Second;
  uint32 WeekInMonth;
  uint32 Year;
};

Secondary options / enchancement:

Schedule via GPO 2 tasks:
- one task remove permission to binary
- one task add permission to binary
OR / AND - one task to run at lunch start time and one and end time - just simple -> gpupdate.

however a user could always copy the program to another location and run it. enter image description here

share|improve this answer
3  
Your noted limitations make this solution completely impractical. The question was about TIMES, not DAYS and if the user turns on the computer just before your WMI filter "lapses", he'll be able to use the software outside of the supposed limited time. –  Dan Jan 13 at 13:27
    
@Dan this is the best I know You can do via GPO if You know better - just answer and if Your answer is better I will vote it up. If someone asks a question about doing something via GPO I understand he probably know how it works ? Satisfied now when I edited my post and added full class info ? –  Bartłomiej Zarzecki Jan 13 at 13:57
1  
My answer is correct - which is that there is no effective way of achieving what he wants with vanilla Windows tools. Your solution is hacky and prone to failure and workarounds, therefore I don't feel it's a good fit for a production education environment. –  Dan Jan 13 at 14:12
1  
Interesting, the more I'm looking into it the more it seems not particularly efficient. Dan, do you have any 3rd party/non-vanilla solution? –  Crimsonfox Jan 13 at 14:22
1  
Given the time constraints you mention yourself with this solution, this is an answer to "how do I make certain apps available at lunchtime" in the same way that amputating your leg at the top of the thigh is a cure for athletes foot. –  RobM Jan 14 at 10:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.