Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to somehow force that one and only one account (in the case the account is shared) is logged to an Active Directory environment at any moment?

What we want to do is to discourage the use of "account sharing" where one user shares its login credentials with another user so he can have network privileges he is not supposed to have (i.e. shared folders access, internet access profile, etc.).

Ideally we would like to force an AD rule where if user_1 is already logged in and then comes another user and tries to log into the network with the same credentials then he is denied access (and create and audit record of the user "collision").

Any pointers/links/help will be greatly appreciated.

share|improve this question
This is a dupe, but I'm having a heck of a time of finding the original question. Help, anybody? – Evan Anderson Nov 6 '09 at 17:39
@Evan I searched for a bit and couldn't find the other question either. I am certain I saw one... – Zoredache Nov 6 '09 at 17:58
up vote 4 down vote accepted

You don't say which version of windows, but if it is for 2000 or 2k3 This technet article will tell you exactly how to do this. It doesn't seem there is a way to do this in 2k8 (at least not that i could find easily)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.