Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a bunch of computers in an OU in my Active Directory. These computers are located on a theoretically less secure site (they are in a warehouse) I want to stop these computers being logged in to (by anyone) between certain hours... Can I do this in Group Policy?

I've seen "Logon Hours" in the account tab in AD but this isn't quite what I want... I wan't to stop the computers from logging in using ANY account between certain times...

share|improve this question
up vote 1 down vote accepted

There isn't functionality built-in to Windows to do what you're looking for.

The idea below is a cheap hack and could easily be subverted, but it might get you what you want w/o using third-party software.

If I were going to do what you're trying to do, I'd build a security template that adds "Users" to the "Deny logon locally" user right assignment, and a second one that removes it (i.e. sets it back to the stock "Guest" only). Once those are built and tested (be careful testing it-- it'll stop even "Administrator" from being able to logon locally) I'd write a script to apply the security templates using a scheduled task. At the appropriate time, apply the template to prevent interactive logons, and then apply the template to restore the ability to logon interactively.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.