script to temporarily block remote users from logging into a windows server during downtime

Question

I'm looking for a solution to the following issue:

we have a windows server with a bunch of people logging in remotely to work on stuff; when we need to upgrade the server, we issue warnings via email and splash screen, asking not to login during the downtime - but people still login which often messes up our upgrade process

here is my question -

is it possible to write a script (Powershell perhaps) - for our system engineer to run at the beginning of the upgrade that would alter permissions/policies for all other users to login remotely (RDP) to this server? She needs to retain a full control over the server, and she is remote also (RDP)

When the upgrade is done, she will run a script again to restore all the permissions/policies for everybody to be able to work on the server via RDP

thanks!

Answer 1

Use Terminal Server Drain Mode (log any users with a session on the terminal server off before you engage Drain Mode).

Turn it off after the maintenance.

https://blogs.msdn.microsoft.com/rds/2007/06/15/introducing-terminal-services-server-drain-mode/

EDIT (4/27/2016)

(to include logon restrictions)

Also, use logon restrictions in Active Directory to limit when people can log on to the system. This way you can set up logon restrictions for your maintenance windows. See this for how to do so: http://ravingroo.com/267/active-directory-user-workstation-logon-restriction/

This would be easily scriptable.

Answer 2

Your best bet it to modify the logon times versus killing sessions. Modifying the logon time ensures that if you follow any kind of RDP Powershell commands that kill a session, won't allow someone to log (or even try to log back in) after a session is stopped. Consider the following: The payroll department is rushing to enter time entries at 7:05PM. You began doing your updates at 7:00PM. HR needs to do what they skimped out on doing at the last second. You kill their session via Powershell. I can assure you even management would be all over you.

Now consider the following: You send an email stating "RDP sessions will be disabled at 6:50PM for maintenance. Kindly finish all work as logons will be disabled" If someone does not do what they need to do in time, you have done your due diligence in giving them more than enough time to finish their work. Afterwards, logon policy disables access, so you don't have to worry about 1) terminating anyone's processes 2) whether or not someone else will be logging in, etc. I would not go with Powershell, WMI or anything else other than manually creating/editing a GPO for logins. In any event, this is a change management issue, and optimally changes should occur during the least used system time.