Force Users to Logoff (GP doesn't do what Microsoft says)

[Guest]

It appears from all the responses to my question ( and the same answer
apparently to many others asking the same ) that Microsoft GP of forcing
users to be logged off once their logoff hours became efective - DOESN'T WORK
AS ONE WOULD EXPECT FROM A LITERAL SENSE !!!!

I wonder what in the world then that Microsft means (their definition) of
forcing users logoff????

Just another example of what ends up having respondents tell me how you can
do something in a different way, because of what Microsofts "intended"
method, would not work!!

Am I wrong Microsoft? Or do you mean that forcing someone to logoff means
something different then the typical English speaker believes it means per
Websters dictionary???

I'm frustrated can you tell - and Microsoft simply strikes again - that's
why so many people turn to alternatvie operating systems (non mentioned as to
not hurt Bill Gates feelings)

If I am wrong then someone at Microsoft and STAND UP and tell ALL OF US how
this GP works then!!!!!!!!!!!!!!!!!!!!!!

 

[Steven L Umbach]

The link below explains exactly what this setting is for and has been
renamed "network security:force logoff when logon hours expire" in Windows
2003 probably to reduce confusion and more accurately describe it's meaning.
It is security policy computer configuration which when enforced on a
computer will cause users connected to that computer via SMB such as a file
share to be disconnected from those file shares hence logging them off of
that computer for their type 3 "network" logon. You can use the command "net
sessions" or use Computer Management/shared folders - sessions to see what
if any users are logged onto a computer via network logon. --- Steve

http://www.microsoft.com/resources/...dowsServ/2003/standard/proddocs/en-us/566.asp

Network security: Force logoff when logon hours expire
Description
This security setting determines whether to disconnect users who are
connected to the local computer outside their user account's valid logon
hours. This setting affects the Server Message Block (SMB) component.

When this policy is enabled, it causes client sessions with the SMB server
to be forcibly disconnected when the client's logon hours expire.

If this policy is disabled, an established client session is allowed to be
maintained after the client's logon hours have expired.

Default: Enabled.

Configuring this security setting
You can configure this security setting by opening the appropriate policy
and expanding the console tree as such: Computer Configuration\Windows
Settings\Security Settings\Local Policies\Security Options\

For specific instructions about how to configure security policy settings,
see To edit a security setting on a Group Policy object.

Note

a.. This security setting behaves as an account policy. For domain
accounts, there can be only one account policy. The account policy must be
defined in the Default Domain Policy, and it is enforced by the domain
controllers that make up the domain. A domain controller always pulls the
account policy from the Default Domain Policy Group Policy object (GPO),
even if there is a different account policy applied to the organizational
unit that contains the domain controller. By default, workstations and
servers that are joined to a domain (for example, member computers) also
receive the same account policy for their local accounts. However, local
account policies for member computers can be different from the domain
account policy by defining an account policy for the organizational unit
that contains the member computers. Kerberos settings are not applied to
member computers.

 

[Jerold Schulman]

It appears from all the responses to my question ( and the same answer
apparently to many others asking the same ) that Microsoft GP of forcing
users to be logged off once their logoff hours became efective - DOESN'T WORK
AS ONE WOULD EXPECT FROM A LITERAL SENSE !!!!

I wonder what in the world then that Microsft means (their definition) of
forcing users logoff????

Just another example of what ends up having respondents tell me how you can
do something in a different way, because of what Microsofts "intended"
method, would not work!!

Am I wrong Microsoft? Or do you mean that forcing someone to logoff means
something different then the typical English speaker believes it means per
Websters dictionary???

I'm frustrated can you tell - and Microsoft simply strikes again - that's
why so many people turn to alternatvie operating systems (non mentioned as to
not hurt Bill Gates feelings)

If I am wrong then someone at Microsoft and STAND UP and tell ALL OF US how
this GP works then!!!!!!!!!!!!!!!!!!!!!!

See tip 8520 and links in the 'Tips & Tricks' at http://www.jsiinc.com for 2 ways to log them off.


Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com