Windows domain.
We close at 5.
I've been asked to disable certain computers/users at 5:15.

I know how to restrict access to the file system on the hour, but
a) that doesn't give enough grace time or too much, and
b) doesn't restrict enough, it only cripples

  • Can you expand on "disable"? Probably this will be a combination of access control and endpoint management. Things like warning users to save and logoff, then forcing them out. – Garrett Oct 28 '20 at 19:21
  • @Garrett Fair question. I think they would be open to anything from preventing the user from using Office to forcing them to log out. – BWhite Oct 28 '20 at 19:26

No, but you can allow users to log on only during certain hours; the setting is in the user account properties in Active Directory:

enter image description here

You can also use a GPO to force users to disconnect if they are logged in when their logon window expires.

Update about granularity:

According to this discussion, the Active Directory attribute which stores this settings doesn't allow for more than single-hour granularity, so it's not possible to specify lesser periods such as 15 or 30 mins, regardless of which tool you use to set it.

  • Thanks for the effort, but this is what we are using now. Doesn't have fine enough granularity. If I set it to 5, they get crippled right away whereas 6 is pointless. Really need that 15 minute grace period. Is there a way to set this with Powershell? That way it could be on at 5:05 and shut off at 5:15. – BWhite Oct 28 '20 at 17:24
  • No way, sorry; see edited answer. – Massimo Oct 28 '20 at 18:25
  • Actually, you answered my question. I can run this at 5:15, set the closing hour back to 5, then GPO force disconnect. – BWhite Oct 28 '20 at 18:42
  • Well, that's... creative for sure. Just look out for AD replication, especially if you have multiple sites. – Massimo Oct 28 '20 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.