3

I'm looking for a solution to the following issue:

we have a windows server with a bunch of people logging in remotely to work on stuff; when we need to upgrade the server, we issue warnings via email and splash screen, asking not to login during the downtime - but people still login which often messes up our upgrade process

here is my question -

is it possible to write a script (Powershell perhaps) - for our system engineer to run at the beginning of the upgrade that would alter permissions/policies for all other users to login remotely (RDP) to this server? She needs to retain a full control over the server, and she is remote also (RDP)

When the upgrade is done, she will run a script again to restore all the permissions/policies for everybody to be able to work on the server via RDP

thanks!

1
  • This will likely get moved to Server Fault, but check my answer out below. Apr 26 '16 at 14:39
4

Use Terminal Server Drain Mode (log any users with a session on the terminal server off before you engage Drain Mode).

Turn it off after the maintenance.

https://blogs.msdn.microsoft.com/rds/2007/06/15/introducing-terminal-services-server-drain-mode/

EDIT (4/27/2016)

(to include logon restrictions)

Also, use logon restrictions in Active Directory to limit when people can log on to the system. This way you can set up logon restrictions for your maintenance windows. See this for how to do so: http://ravingroo.com/267/active-directory-user-workstation-logon-restriction/

This would be easily scriptable.

2
  • this is really interesting! do you happen to know if the Drain Mode will also prevent the server's files being accessed/locked through the network (in shared folders) Apr 26 '16 at 17:42
  • It will only prevent terminal services connections from being made to the server... any shared folders or other resources will still be accessible... to stop that you'd have to almost terminate the network connection, and by terminate I mean disconnect... Apr 26 '16 at 20:18
1

Your best bet it to modify the logon times versus killing sessions. Modifying the logon time ensures that if you follow any kind of RDP Powershell commands that kill a session, won't allow someone to log (or even try to log back in) after a session is stopped. Consider the following: The payroll department is rushing to enter time entries at 7:05PM. You began doing your updates at 7:00PM. HR needs to do what they skimped out on doing at the last second. You kill their session via Powershell. I can assure you even management would be all over you.

Now consider the following: You send an email stating "RDP sessions will be disabled at 6:50PM for maintenance. Kindly finish all work as logons will be disabled" If someone does not do what they need to do in time, you have done your due diligence in giving them more than enough time to finish their work. Afterwards, logon policy disables access, so you don't have to worry about 1) terminating anyone's processes 2) whether or not someone else will be logging in, etc. I would not go with Powershell, WMI or anything else other than manually creating/editing a GPO for logins. In any event, this is a change management issue, and optimally changes should occur during the least used system time.

1
  • GPO for logins - to be in effect only during the downtime? if yes - how to switch it on?
    – Oleg Ivanov
    Apr 26 '16 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.