RE: Preventing multiple logins in 2003

From: Howard, Ken (Ken.Howard_at_heald.edu)
Date: 02/01/05

  • Next message: Boris Skoblo: "disclosure the administrative password" 
    To: Miroslaw Slawek Chorazy <mchorazy@depaul.edu>, larobins@bellatlantic.net, ian.turnbull@mpsgi.com, focus-ms@securityfocus.com
Date: Mon, 31 Jan 2005 21:43:25 -0800

    We looked at this for a while and decided it was not worth the $.

    That being said, a free solution is to set your users home drive (on a
    network share obviously) to only allow one concurrent connection and add
    logic at the end of the logon script (we use .vbs scripts) to check whether
    or not that users home drive was mapped - if it was, then they are not
    logged on elsewhere, if it is not mapped, then either the file server is not
    available, or the user has that share locked on another workstation.
    Obviously you should be using DFS or some other mechanism to limit your
    exposure to a single point of failure and add logic to check that the file
    server is available and is simply refusing the connection. We never got any
    further than that, and in the preliminary testing, we needed more than one
    concurrent session available to the users - no I don't remember why...

    Anyway, with the advances in WMI, and the exposure of system objects through
    Windows Scripting Host, you can accomplish a great deal with logon
    scripts...

    Just my 2cents...

    Ken Howard

    "Whoever fights monsters should see to it that in the process he does not
    become a monster." Friedrich Wilhelm Nietzsche

    -----Original Message-----
    From: Miroslaw Slawek Chorazy [mailto:mchorazy@depaul.edu]
    Sent: Friday, January 28, 2005 3:50 PM
    To: larobins@bellatlantic.net; ian.turnbull@mpsgi.com;
    focus-ms@securityfocus.com
    Subject: RE: Preventing multiple logins in 2003

    cconnect exposes the password that is needed to connect to the SQL database
    in clear in the registry!

    slawek

    >>> "Laura A. Robinson" <larobins@bellatlantic.net> 1/27/2005 19:20
    >>>
    Have you tried cconnect?

    Laura

    > -----Original Message-----
    > From: Ian Turnbull [mailto:ian.turnbull@mpsgi.com]
    > Sent: Wednesday, January 26, 2005 12:22 PM
    > To: focus-ms@securityfocus.com
    > Subject: Preventing multiple logins in 2003
    >
    >
    >
    > Folks,
    >
    > It has been noted that some of our user base are allowing other
    > members of staff to login using their user account. We are currently
    > in the process of moving to a fully functional
    > 2003 domain and I would like to disable concurrent logons via group
    > policy. Any suggestions?
    >
    > Regards
    >
    > Ian
    >
    > --------------------------------------------------------------
    > -------------
    > --------------------------------------------------------------
    > -------------
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

    This communication may contain Heald College confidential and proprietary data.
    Any questions should be directed to a Heald College IT administrator.

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Boris Skoblo: "disclosure the administrative password"

    Relevant Pages

    • RE: Login scripts not executing
      ... We are using windows 2003 in bothe the forests. ... We are not using Group Policy for logon scripts, ... controller and given the path in the user properties-profiles-logon scripts. ...
      (microsoft.public.win2000.active_directory)
    • RE: Adding Groups on the basis of text in a VBScript
      ... Firstly we need to read multiple text files, which are acting as logon ... If the Datalink string is present the filename of the file being read should ... > WScript.Echo " You are a member of Domain Admins " ... >> scripts which utilize vbscript. ...
      (microsoft.public.windows.server.scripting)
    • Re: report logon / logoff times of users
      ... Windows users don't really "logon to the network" even though we may all ... You can certainly audit Account Logon and the dump the logon and logoff ... I've used logon and logoff scripts that append information to log files. ...
      (microsoft.public.windows.server.active_directory)
    • Re: RDP logn script override?
      ... Are the logon scripts assigned via Group Policy? ... RDP boxes in a separate OU, and apply a GPO to that OU. ...
      (microsoft.public.scripting.vbscript)