How to Use a Network Share to Limit a User's Concurrent Connections in Windows 2000 (260364)

MORE INFORMATION

Overview

• An available shared folder for each user whose logons you want to limit.
• A user logon script.
• The Logoff.exe tool from the Windows 2000 Server Resource Kit.

Implement Concurrent Logon Restrictions

1. Create and share a folder on a server for each user who you want to apply log on restrictions to (if you are not using existing shares). To do so:
   1. Start Windows Explorer.
   2. In the Folders list, click the folder where you want to create your new shared folder (for example, Documents and Settings).
   3. On the File menu, point to New, and then click Folder. Type a name for the folder, and then press ENTER.
   4. Right-click the new folder (or the folder that you want to share), and then click Sharing.
   5. Click Share this folder.
   6. Under User limit, click Allow. In the Users dialog box, type the number of concurrent logon sessions that you want to limit the user to.
2. Create a logon script.
   
   1. Use a text editor to create the following batch file:

      net use T: /delete
      net use T: \\<Servername>\<sharename>
      if exist T: goto end
      if not exist T: goto logout
      :logout
      echo Y | logoff.exe
      :end	

   2. Save the file with a .bat extension in the Netlogon share of the domain controller.
   3. To restrict concurrent logons for specific user accounts, use this logon script or incorporate the script in an existing logon script.
   Note This example uses drive T. You can substitute any drive letter for "T." Also, if you specify the user's home folder, you can use the %USERNAME% environment variable instead of the share name.
3. Copy the Logoff.exe tool from the Windows 2000 Server Resource Kit, and then copy the logon script that you just created to the domain controller's Netlogon share.

Limitations

• Do not use this method if business considerations require enforcement of concurrent logons. In these situations, use either the Cconnect.exe Windows 2000 Resource Kit tool or Smart Card logon to enforce the number of concurrent logons.
• If users can cancel logon scripts, they can also circumvent the concurrent logon limitations. To prevent users from canceling a logon script before it completes, configure the clients to run the logon script synchronously, or to run the script in the background so that it is not visible to the user.
• If the server that hosts the share cannot be reached, or if the logon script does not process, users may be able to avoid the restrictions that the share method is designed to impose.
• Users may be able to gain access to network resources by using cached credentials (for example, on a portable computer). You can remove cached logon information; however, unless there is a strong concurrent connection enforcement policy, this is not a good idea because you may unintentionally prevent users from accessing network resources.