Logoff when AD Logon hours expire about idle-logoff HOT 11 CLOSED

How about creating a scheduled task? You can deploy that through GPO as well.

from idle-logoff.

What would be the trigger?

from idle-logoff.

Smooley, you set your parameters in the scheduled task (i.e. time/date). You don't need AD at all. You could however, use GPO to push out the scheduled task.

For example:

Trigger: Daily at 3:00 PM Recur every 1 day
start a program
Point to program that will auto-log-out user

done

from idle-logoff.

But I want the logout time to be tied to the AD Logon hours of the account. So when their AD Logon hours expire, they are forcibly logged off their workstation.

from idle-logoff.

You could create separate GPOs for different schedules, i.e. task schedules

One set of users:
Trigger: Daily at 3:00 PM Recur every 1 day
start a program
Point to program that will auto-log-out user

Second set of users:
Trigger: Daily at 5:00 PM Recur every 1 day
start a program
Point to program that will auto-log-out user

done

from idle-logoff.

The other way you can do this is on the server side.

I shutdown computers daily and weekly via calling a simple batch file from my server.

Example:
shutdown -s -f -m \\mpltw.arps.local

The time and dates can be whatever I choose them to be and I can have multiple combinations on the same server.

from idle-logoff.

Thanks for the suggestions, but none of this accomplishes what I am trying to achieve. Which is log a user off when their Active Directory Logon Hours expire.

from idle-logoff.

Smooley, I'm a little confused because when you set the AD hours it will automatically disconnect the session at the time specified. The only thing you are accomplishing is casing the computer to logoff, which in itself is not useful. So, why can't you have a general script to logout all computers at the end of the day or when idle?

from idle-logoff.

SMB sessions are disconnected, but the user is still logged on and able to continue using the workstation past their logon hours for anything local and web browsing. Management want them off. Even if they time out or disconnect, tasks are still running that are continually trying to access things on the network that cause tons of failed logon attempts in my siem. So, in this case, a forced logoff is not only useful, it is the only way to accomplish want we want. A forced idle logout won't work because they could be idle for extended periods during their allowed logon hours and that is fine. A general script to log them off at the end of the day wont work because they have different schedules.

from idle-logoff.

The only way you're going to accomplish this is via GPO. If you figure out another way. Let me know. Good luck!

https://blogs.technet.microsoft.com/askds/2010/08/24/forcing-afterhours-user-logoffs/

from idle-logoff.

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs.

from idle-logoff.