Windows Set Domain User Time Limit

The below commands can be run in Command Prompt:
  • Enable time restriction
    net user joe /times:M-F,3pm-9pm;Sa-Su,9am-11am
  • Disable time restriction
    net user joe /times:all
  • Check current status
    net user joe

With the above settings, only Logon is restricted.  You can enable force log off with below settings:

  1. Press Win+R, then type gpedit.msc.
  2. Under User Configuration -> Administrative Templates -> Windows Components -> Windows Logon Options, click on Set Action to take when logon hours expire.
  3. Choose Enabled, then set the action to Lock or Logoff, depending on your needs.
With Domain Group Policy, you can enable like this:
  1. Create a group policy object
    1. Run Active Directory Users and Computers.
    2. Right click the respective object, then select Properties.
    3. Select "Group Policy" tab.  Click New
    4. Enter a name for the policy and then press Enter.
    5. Click Properties and then Security
    6. Click to select the Apply Group Policy check box for the groups that you want to have this policy applied. Click OK to finish.
  2. Enforce logon hour restriction
    1. Start the Active Directory Users and Computers snap-in.
    2. In the console tree, right-click your domain or the organizational unit that contains the domain controller GPO that you want to edit, and then click Properties.
    3. Click the Group Policy tab, select the GPO that you want, and then click Edit.
    4. Under Computer Configuration - Windows Settings - Security Settings - Local Policies - Security Options.
    5. In the right pane of the Group Policy snap-in, double-click
      Microsoft network server: Disconnect clients when logon hours expire.
    6. Click to select the Define this policy setting check box, click Enabled, and then click
    7. Close the Group Policy snap-in, and then click
Vice versa, you may run NET ACCOUNTS /FORCELOGOFF:0 at the computer to make sure it force logout a user upon time limit reached.



Popular Posts