prevent users from loging into certain workstations on a domain

[techidave]

I have been unsuccessful in finding an answer on google for this subject so I thought I would ask here.  I will present what I would like to accomplish.

I have certain XP workstations on our windows network that I would like to prevent users from logging in until a certain time.  We run XP Pro workstations with Windows 2003 Server running Active Directory.  I want to prevent any student from being able to log in and perhaps all users as well until say noon.

I know there is a login hours setting on each user properties account but I would have to do all users and that is not acceptable as they have to be able to log in to lab and library computers during the morning hours. 

I have also searched the local policy using gpedit.msc but didn't see a setting there either. 

I feel the solution is probably a simple one and I am just over looking it but where? 

[Carol Haynes]

Do these help (esp. the second link)?

http://technet2.microsoft.com/windowsserver/en/library/a0f007ba-b3ef-4c1f-8836-9087fe5eb08d1033.mspx?mfr=true

http://support.microsoft.com/kb/816666/en-us

[techidave]

thanks Carol for the links.  The first link doesn't because the users need to be able to log in on certain computers in other rooms at different times.  The second link talks about the net user command which would accomplish what I want to do.  I thought of it last nite after I had already posted.  That just confirmed that it would work.

I told you the answer was simple!

I know this forum does not specialize in networking but with the wealth of knowledge here, I new someone would come up with the answer.

You all are the best!

Dave

[Carol Haynes]

I am just trying to get to grips with Windows Server 2003 (but I know how to use the MSKB  )

Have you any suggestions on how to get started building a domain with no prior knowledge?

I have bought a book which is quite good and it tells you how to set up the active directory service, DNS service etc. but it doesn't tell me how to get other computers to actually connect to the server or even how to check that the server is running properly.

Under the education scheme I got a free copy of Server 2003 Standard to play with so I have set up a virtual network in VMWare (mixed clients Windows 2000, XP and Vista - though at the moment I am only trying to get the XP client working) - trouble is it doesn't seem to matter what I do I don't seem to be able to login to the server from the clients or join them to the domain. They can all 'see' the domain but just not actually move out of workgroup mode and join the domain!!!

It's all very frustrating - and almost everything you read about Windows Server requires about 10 years prior knowledge of geekspeak !!

Also do you have any good pointers on planning the actually network setup (for when I go physical with a domain controller) - including things like wiring, mixed wired and wifi networks.

Anything you can suggest would be really useful.

[Carol Haynes]

One other quick question - can you set up clients to be members of Workgroups and Domains simultaneously ?

[techidave]

It seems like I have some info I can send to you or some web links but all that is on a different computer that may be of some help.  I will send you some screen shots of how I join them to the domain also.  That may be more useful than telling you.

the answer to your last question is no.  If its a member of the domain then you would have to unjoin it from the domain for it to be part of a workgroup.  Unless there is another solution that I am not aware of.

[Carol Haynes]

Thanks that would be really useful.

[techidave]

There is a wizard in w2k3 called "managing your server" that helps with the setup.  Just take it in the order shown in the wizard and you will be fine.  Be sure to set a static DNS on the server itself.

see the screenshots that shows how I join them to a domain.  XP by default, is automatically set to WORKGROUP and that will need to be changed as shown.  I do not use the network change ID button its always the change button.

the second attachment shows the name of the domain, in my case doman.local.

this site has some good info on it also: http://windowsitpro.com/article/articleid/38996/how-can-i-use-windows-server-2003s-manage-your-server-wizard.html

If someone could point me in the right direction for instructions on how to place pictures in the post, I would be forever grateful.

Hope this makes sense to you.

[techidave]

woops!  I forgot the second screen shot. 

[techidave]

Double woops!   the name of our domain is domain.local but you can call it anything you like.

Once  you type in the name of your domain in the text box it will come up and ask you for a user name and password that is necessary to complete this task.  You can use the one you set up when you setup the server.  It takes a minute to two to complete this task and then after answering ok 2 times you will have to restart your workstation.

This page here says it a lot better than I did above.
http://www.visualwin.com/AD-XP/

[Carol Haynes]

Thanks ... I'll have a play when my system stops crashing!

By the way to insert attached pictures into the text browse and add them as usual and then in the message insert something like:

[attachimg=1]

Replace the number for multiple images - they are numbered 1, 2, 3 ... from the top of the list of attached image files.

If you use the new post or full reply window (rather than the quick reply box below) you will see a drop down menu top left of the editing pane called "Link Inline Image ..." you can insert the tag from there and just edit the number - there are various options including fullsize and clickable thumbnails.

Have a play with it in reply to this post

[techidave]

[attachment 1 not found]

lets see how this works.

edit: picture deleted

[techidave]

woops.

[attachment 1 not found]

edit: this looks better.

edit: picture deleted

[Carol Haynes]

You got it - do you mind deleting the images (togrther they are ~1.5Mb - which is a lot given the number of people who open the pages around here!).

You can delete them just by hitting Modify above the post and deleting (or replacing) the attachment.