I have a Windows Server 2012 server that allows remote desktop users (sessions are hosted on the server itself). I'm trying to enforce logon hours for these remote desktop users.
I have specified logon hours for a user and confirmed that they work--they aren't allowed to logon when logon hours are disabled. However, they are allowed to continue a session past their logon hours limit if they are already signed in (which is fine, this is the default behavior).
However, when I try to use the
Set action to take when logon hours expire option (
User Configuration/Administrative Templates/Windows Components/Windows Logon Options/Set action to take when logon hours expire), and set the behavior to "Logoff", nothing happens--the user can continue their session happily. I've tried applying this policy both for the user's group and for the local computer. I've run
gpresult for the user and confirmed that the policy is apparently in place.
I also naively tried the "Force logoff when logon hours expire" option, but that apparently doesn't apply to interactive logins (confusing!).
Am I misapplying this setting, or do I need to take some other steps to get it to work? I'd be grateful for any input. Thanks!
So, based on the comment from @RobM and other discussions online, it sounds like this policy doesn't really work (at least not as expected). Is there any official MS documentation for this policy (I looked around some online and couldn't find much), or are there any resources that might cover it?
Assuming this policy is not an option, one possible workaround would be a scheduled task to log users off when their logon hours expire. However, each users' hours may be different, so I cannot use a time-of-day trigger. Is there some "logon hours expired" event (e.g. in the event logs) that I could hook into to run the logoff task?