Tip: Run a free scan for common Windows errors ad

re: Login Hours Wednesday, February 13, 2002 at 2:31 am Posted by Dale Horner (10 messages posted) Normally you would change the logon hours in the actual users profile of active Directory. Goto the User and select properties, select account and then logon hours and configure the time allowed there. I dont think you can configure groups you have to apply it to individual users. Hope this helps.. On Tuesday, February 12, 2002 at 1:11 pm, Matt wrote: >I have a problem and am wondering if anyone can help. I am trying to configure active >dir so that when the user's logon time period is finished, they are automatically >logged off... > >I have tried everything. Now I have it set up with the users in a group (where, natrually, >the policy is to automatically log them off when time expires) and I have the group, >the user and the users computer all listed in the OU I created specifically to sub-divide >them... Anyone have any ideas to help? There must be something I am missing.... Thanks >.... - Matt > >Matthew Montalto [Reply or follow-up to this message] re: Login Hours Wednesday, February 13, 2002 at 4:43 am Posted by Matt (7 messages posted) Thanks, but the directive I am trying to accomplish is to have the user (whose login hours are already set) automatically logged off when their permitted time expires.... Any ideas on that? On Wednesday, February 13, 2002 at 2:31 am, Dale Horner wrote: >Normally you would change the logon hours in the actual users profile of active Directory. >Goto the User and select properties, >select account and then logon hours and configure the time allowed there. >I dont think you can configure groups you have to apply it to individual users. > >Hope this helps.. > > > >On Tuesday, February 12, 2002 at 1:11 pm, Matt wrote: >I have a problem and am wondering if anyone can help. I am trying to configure active >dir so that when the user's logon time period is finished, they are automatically >logged off... > >I have tried everything. Now I have it set up with the users in a group (where, >natrually, >the policy is to automatically log them off when time expires) and I have the group, >the user and the users computer all listed in the OU I created specifically to sub-divide >them... Anyone have any ideas to help? There must be something I am missing.... >Thanks >.... - Matt > >Matthew Montalto > [Reply or follow-up to this message] re: Login Hours Wednesday, February 13, 2002 at 5:16 am Posted by Curt R (1315 messages posted) At what level are you applying the GPO for logging users off after their time expires? GPO's can be applied at the Local, Site, Domain, or OU level, but not to groups or users. On Wednesday, February 13, 2002 at 4:43 am, Matt wrote: > >Thanks, but the directive I am trying to accomplish is to have the user (whose login >hours are already set) automatically logged off when their permitted time expires.... >Any ideas on that? > > >On Wednesday, February 13, 2002 at 2:31 am, Dale Horner wrote: > >Normally you would change the logon hours in the actual users profile of active >Directory. >Goto the User and select properties, >select account and then logon hours and configure the time allowed there. >I dont think you can configure groups you have to apply it to individual users. > >Hope this helps.. > > > >On Tuesday, February 12, 2002 at 1:11 pm, Matt wrote: >I have a problem and am wondering if anyone can help. I am trying to configure active >dir so that when the user's logon time period is finished, they are automatically >logged off... > >I have tried everything. Now I have it set up with the users in a group (where, >natrually, >the policy is to automatically log them off when time expires) and I have the group, >the user and the users computer all listed in the OU I created specifically to sub-divide >them... Anyone have any ideas to help? There must be something I am missing.... >Thanks >.... - Matt > >Matthew Montalto > > [Reply or follow-up to this message] re: Login Hours Wednesday, February 13, 2002 at 5:37 am Posted by Matt (7 messages posted) OK, Curt... I believe I have it applied it to the domain, the local and the OU level. I have even set the GP for the Default Domain Policy to automatically log off users when their time expires.... So I have that setting applied in the OU and for the domain..... And I have the users added to the OU (and, of course, the domain). I have also moved the compuer of the target user into the OU, and still no go... What am I missing here?... any ideas? Thanks for you help..... much appreciate it.... On Wednesday, February 13, 2002 at 5:16 am, Curt R wrote: > At what level are you applying the GPO for logging users off after their time >expires? GPO's can be applied at the Local, Site, Domain, or OU level, but not to >groups or users. > > >On Wednesday, February 13, 2002 at 4:43 am, Matt wrote: > >Thanks, but the directive I am trying to accomplish is to have the user (whose login >hours are already set) automatically logged off when their permitted time expires.... >Any ideas on that? > > >On Wednesday, February 13, 2002 at 2:31 am, Dale Horner wrote: > >Normally you would change the logon hours in the actual users profile of active >Directory. >Goto the User and select properties, >select account and then logon hours and configure the time allowed there. >I dont think you can configure groups you have to apply it to individual users. > >Hope this helps.. > > > >On Tuesday, February 12, 2002 at 1:11 pm, Matt wrote: >I have a problem and am wondering if anyone can help. I am trying to configure active >dir so that when the user's logon time period is finished, they are automatically >logged off... > >I have tried everything. Now I have it set up with the users in a group (where, >natrually, >the policy is to automatically log them off when time expires) and I have the group, >the user and the users computer all listed in the OU I created specifically to sub-divide >them... Anyone have any ideas to help? There must be something I am missing.... >Thanks >.... - Matt > >Matthew Montalto > > [Reply or follow-up to this message] re: Login Hours Wednesday, February 13, 2002 at 5:56 am Posted by Curt R (1315 messages posted) Ok, to start with, do you want this to affect all users in the domain, or just the ones in the OU? If OU, set your GPO only at that level. You will want to remove it from the local PC as too many GPO's can conflict and the best way to apply them is only one time and to avoid filtering. When you are setting up your GPO, where inside the Policy Editor are you applying the setting, on the computer or on the user? On Wednesday, February 13, 2002 at 5:37 am, Matt wrote: >OK, Curt... I believe I have it applied it to the domain, the local and the OU level. >I have even set the GP for the Default Domain Policy to automatically log off users >when their time expires.... > >So I have that setting applied in the OU and for the domain..... And I have the users >added to the OU (and, of course, the domain). I have also moved the compuer of the >target user into the OU, and still no go... What am I missing here?... any ideas? > >Thanks for you help..... much appreciate it.... > > > [Reply or follow-up to this message] re: Login Hours Wednesday, February 13, 2002 at 6:27 am Posted by Matt (7 messages posted) OK, I am applying the setting to the group I created which is in the OU... I am right clicking the ou (i.e. Matts OU), going to properties, 'Group Policy' tab, then selecting the policy (i.e. Matts OU Group Policy) and clicking "edit". (By the way....Thanks for your time and patience Curt... I really appreciate it... This thing has be bugging the hell out of me....) Ok.... You seem like a really bright guy, maybe it would help if I give you all the backround info, and then I listen to your method to doing this.... W2k box is named "Server"... thats the PDC for the domain "mattmontalto". PC #1 is named "matthew". Target user is "mmontalto" ACTIVE DIR STRUCTURE: I have created and OU called "Matts OU". Under that is "matthew" (the physical computer), the group "Matts OU", and the user "mmontalto". The user, "mmontalto" is a 'member of' "Domain Users" & "Matts OU".... Now, under the GP for Matts OU, we have "Matts OU Group Policy", under which I have enabled BOTH "Automatically log off users when time expires", and "Automatically log off users when time expires (Locally)"... Do you think that because they are BOTH enabled, they are conflicting? Hey Curt.... Sorry to make this such a huge post, but I thought it might be better if we were both looking at the same page.... So I, again, thank you very much for your time, help and patience.... Like I said before.... This thing is driving me crazy.... Thanks ... On Wednesday, February 13, 2002 at 5:56 am, Curt R wrote: > Ok, to start with, do you want this to affect all users in the domain, >or just the ones in the OU? If OU, set your GPO only at that level. You will want >to remove it from the local PC as too many GPO's can conflict and the best way to >apply them is only one time and to avoid filtering. When you are setting up your >GPO, where inside the Policy Editor are you applying the setting, on the computer >or on the user? > > >On Wednesday, February 13, 2002 at 5:37 am, Matt wrote: >OK, Curt... I believe I have it applied it to the domain, the local and the OU level. >I have even set the GP for the Default Domain Policy to automatically log off users >when their time expires.... > >So I have that setting applied in the OU and for the domain..... And I have the >users >added to the OU (and, of course, the domain). I have also moved the compuer of >the >target user into the OU, and still no go... What am I missing here?... any ideas? > >Thanks for you help..... much appreciate it.... > > > [Reply or follow-up to this message] re: Login Hours Wednesday, February 13, 2002 at 7:45 am Posted by Curt R (1315 messages posted) Your AD structure helps a lot! As far as I can see, everything looks good. A GPO applied to a container affects every object in that container and below. You're not using any policy filtering or blocking and that's all good too (you want to avoid this whenever possible) I think the problem you're having may be related to the dual settings. Now I'm not exactly sure how you're applying the two settings. The "Automatically log off users when time expires (Locally)", is that a Local policy on the client PC? If it is, it could be the problem. I suggest you start fresh by removing all Local and Domain policies that you've been testing and leave just the OU policy in place. Edit it again and ensure that you are setting the "Automatically log off..." setting in the User Configuration portion of the Policy Editor. Once you've done that, reboot both machines if possible. If that's not convenient, you can refresh the policy manually via the Run command by typing in secedit /refreshpolicy user_policy on your DC. Then log off the client and back on. If the policy doesn't apply properly you may need to reboot the client PC. Get back to me and let me know if that straightens it out. If not, we'll check and see what else may be causing you grief. On Wednesday, February 13, 2002 at 6:27 am, Matt wrote: >OK, I am applying the setting to the group I created which is in the OU... I am right >clicking the ou (i.e. Matts OU), going to properties, 'Group Policy' tab, then selecting >the policy (i.e. Matts OU Group Policy) and clicking "edit". > >(By the way....Thanks for your time and patience Curt... I really appreciate it... >This thing has be bugging the hell out of me....) > >Ok.... You seem like a really bright guy, maybe it would help if I give you all the >backround info, and then I listen to your method to doing this.... W2k box is named >"Server"... thats the PDC for the domain "mattmontalto". PC #1 is named "matthew". >Target user is "mmontalto" > >ACTIVE DIR STRUCTURE: > >I have created and OU called "Matts OU". Under that is "matthew" (the physical computer), >the group "Matts OU", and the user "mmontalto". > >The user, "mmontalto" is a 'member of' "Domain Users" & "Matts OU".... > >Now, under the GP for Matts OU, we have "Matts OU Group Policy", under which I have >enabled BOTH "Automatically log off users when time expires", and "Automatically >log off users when time expires (Locally)"... > >Do you think that because they are BOTH enabled, they are conflicting? > >Hey Curt.... Sorry to make this such a huge post, but I thought it might be better >if we were both looking at the same page.... So I, again, thank you very much for >your time, help and patience.... Like I said before.... This thing is driving me >crazy.... Thanks ... [Reply or follow-up to this message] re: Login Hours Wednesday, February 13, 2002 at 11:11 am Posted by Matt (7 messages posted) OK.... I removed the policy: "Matts OU Group Policy", I cant remove the default somain policy... and the "automatically log offf...." setting is only in the computer configuration setting.... doesnt seem to be in the user config setting.... Did some experimenting though, and it seems that whatever setting I affect (in user or computer settings), the effect seems to only take place locally... on the server itself.... i.e. "Hide All Desktop Icons" settings will hide them all on the server only.... I notice that when I go to edit group policy for matts ou group policy, OR for the default domain policy, that at the top of the tree (where it says the name of the policy being edited), its says.... in my case...: "Matts OU Group Policy [SERVER] Policy" or "Default Domain Policy [SERVER] Policy"... ("SERVER" is the name designated for my w2k server) so it seems that I must need to edit the policy for the other stations? Kind of confused on how to do that though.... been through computer mgmt for them.... cant seem to edit their settings there..... Any Ideas?... Thanks. On Wednesday, February 13, 2002 at 7:45 am, Curt R wrote: > Your AD structure helps a lot! As far as I can see, everything looks good. A >GPO applied to a container affects every object in that container and below. You're >not using any policy filtering or blocking and that's all good too (you want to avoid >this whenever possible) I think the problem you're having may be related to the >dual settings. Now I'm not exactly sure how you're applying the two settings. The >"Automatically log off users when time expires (Locally)", is that a Local policy >on the client PC? If it is, it could be the problem. I suggest you start fresh >by removing all Local and Domain policies that you've been testing and leave just >the OU policy in place. Edit it again and ensure that you are setting the "Automatically >log off..." setting in the User Configuration portion of the Policy Editor. > Once you've done that, reboot both machines if possible. If that's not convenient, >you can refresh the policy manually via the Run command by typing in secedit /refreshpolicy >user_policy on your DC. Then log off the client and back on. If the policy >doesn't apply properly you may need to reboot the client PC. Get back to me and >let me know if that straightens it out. If not, we'll check and see what else may >be causing you grief. > > >On Wednesday, February 13, 2002 at 6:27 am, Matt wrote: > >OK, I am applying the setting to the group I created which is in the OU... I am >right >clicking the ou (i.e. Matts OU), going to properties, 'Group Policy' tab, then selecting >the policy (i.e. Matts OU Group Policy) and clicking "edit". > >(By the way....Thanks for your time and patience Curt... I really appreciate it... >This thing has be bugging the hell out of me....) > >Ok.... You seem like a really bright guy, maybe it would help if I give you all >the >backround info, and then I listen to your method to doing this.... W2k box is named >"Server"... thats the PDC for the domain "mattmontalto". PC #1 is named "matthew". >Target user is "mmontalto" > >ACTIVE DIR STRUCTURE: > >I have created and OU called "Matts OU". Under that is "matthew" (the physical >computer), >the group "Matts OU", and the user "mmontalto". > >The user, "mmontalto" is a 'member of' "Domain Users" & "Matts OU".... > >Now, under the GP for Matts OU, we have "Matts OU Group Policy", under which I have >enabled BOTH "Automatically log off users when time expires", and "Automatically >log off users when time expires (Locally)"... > >Do you think that because they are BOTH enabled, they are conflicting? > >Hey Curt.... Sorry to make this such a huge post, but I thought it might be better >if we were both looking at the same page.... So I, again, thank you very much for >your time, help and patience.... Like I said before.... This thing is driving me >crazy.... Thanks ... [Reply or follow-up to this message] re: Login Hours Wednesday, February 13, 2002 at 2:03 pm Posted by Curt R (1315 messages posted) Right, you can't remove the default Domain policy. Just make sure you've edited it to remove any changes you made regarding these log off settings. My big disadvantage in trying to help you troubleshoot this is not having AD installed on my server so I'm trying to do this from memory. Once you've reset all policies edit one on the OU you wish to apply it to. I thought the "automatically log off user..." setting was in both computer and user configuration but I guess I was wrong. Since it only applies to computers I'm not sure it'll work how you want it to. I'm going to be able to lab this out tomorrow so I'll quickly check once I'm working on an AD integrated DC and I'll get back to you with my results then. Before an applied policy will take effect you have to allow time for replication to happen. The secedit /refreshpolicy command only works locally, and won't affect other PC's or users until replication has taken place between your DC's. Replication can take up to about 15 minutes by default but can be forced in AD Sites. Since this is a computer configuration setting the correct secedit command is as follows: secedit /refreshpolicy machine_policy. On Wednesday, February 13, 2002 at 11:11 am, Matt wrote: >OK.... I removed the policy: "Matts OU Group Policy", I cant remove the default somain >policy... and the "automatically log offf...." setting is only in the computer configuration >setting.... doesnt seem to be in the user config setting.... Did some experimenting >though, and it seems that whatever setting I affect (in user or computer settings), >the effect seems to only take place locally... on the server itself.... i.e. "Hide >All Desktop Icons" settings will hide them all on the server only.... I notice that >when I go to edit group policy for matts ou group policy, OR for the default domain >policy, that at the top of the tree (where it says the name of the policy being edited), >its says.... in my case...: "Matts OU Group Policy [SERVER] Policy" or "Default >Domain Policy [SERVER] Policy"... ("SERVER" is the name designated for my w2k server) >so it seems that I must need to edit the policy for the other stations? Kind of >confused on how to do that though.... been through computer mgmt for them.... cant >seem to edit their settings there..... Any Ideas?... Thanks. [Reply or follow-up to this message] re: Login Hours Thursday, February 14, 2002 at 2:51 pm Posted by Matt (7 messages posted) Ok, Did some experimenting.... First of all, I decided to delete the OU..... Now I am focusing only on editing the "Default Domain Policy"... In the AD structure I have all the stations in the "Computers" folder, the server itself in the "Domain Contollers" folder, and the users in the "Users" folder. Now... I am going to the domain "mattmontalto" and right clicking and going to properties, - GP - and then "edit" (editing the default domain policy). From there i am going to "user config" and in the folder: Administrative Templates\Start Menu & Taskbar, I am enabling something that would be a noticable command.... - such as hiding the "Run" command from the start menu. Now... I manually refesh my user policy and log out & in the stations and the server.... However, for some reason, the "run" command is only hidden on the Server's start menu and NOT on any of the staions.--- So I left it for a couple hours and the logging in on one of the stations again, and still no change. Pretty stumped at this point .... for some reason, the effects of the settings I change are only appearing locally..... Is it possible that I need to be running some type of login script for my users in order for their machines to be affected by the changes I make?.. Once again.... Thanks for listening .... I really appreciate it..... On Wednesday, February 13, 2002 at 2:03 pm, Curt R wrote: > Right, you can't remove the default Domain policy. Just make sure you've edited >it to remove any changes you made regarding these log off settings. My big disadvantage >in trying to help you troubleshoot this is not having AD installed on my server so >I'm trying to do this from memory. Once you've reset all policies edit one on the >OU you wish to apply it to. I thought the "automatically log off user..." setting >was in both computer and user configuration but I guess I was wrong. Since it only >applies to computers I'm not sure it'll work how you want it to. I'm going to be >able to lab this out tomorrow so I'll quickly check once I'm working on an AD integrated >DC and I'll get back to you with my results then. Before an applied policy will >take effect you have to allow time for replication to happen. The secedit /refreshpolicy >command only works locally, and won't affect other PC's or users until replication >has taken place between your DC's. Replication can take up to about 15 minutes by >default but can be forced in AD Sites. Since this is a computer configuration setting >the correct secedit command is as follows: secedit /refreshpolicy machine_policy. > > >On Wednesday, February 13, 2002 at 11:11 am, Matt wrote: >OK.... I removed the policy: "Matts OU Group Policy", I cant remove the default >somain >policy... and the "automatically log offf...." setting is only in the computer configuration >setting.... doesnt seem to be in the user config setting.... Did some experimenting >though, and it seems that whatever setting I affect (in user or computer settings), >the effect seems to only take place locally... on the server itself.... i.e. "Hide >All Desktop Icons" settings will hide them all on the server only.... I notice that >when I go to edit group policy for matts ou group policy, OR for the default domain >policy, that at the top of the tree (where it says the name of the policy being >edited), >its says.... in my case...: "Matts OU Group Policy [SERVER] Policy" or "Default >Domain Policy [SERVER] Policy"... ("SERVER" is the name designated for my w2k server) >so it seems that I must need to edit the policy for the other stations? Kind of >confused on how to do that though.... been through computer mgmt for them.... cant >seem to edit their settings there..... Any Ideas?... Thanks. [Reply or follow-up to this message] re: Login Hours Thursday, February 14, 2002 at 4:33 pm Posted by Curt R (1315 messages posted) Well from the sounds of it, you're doing everything correctly and I'm at a loss as to why it's not working. I wasn't able to lab this (lack of time) but I talked it over with a friend and neither one of us can think of a reason why this isn't working for you. I'm even more stumped after reading this post of yours. I've played with things like removing the Run command many times and never encountered a problem. Without being able to sit down at your DC and do some snooping around I really can't think of what else I can do for your situation. On Thursday, February 14, 2002 at 2:51 pm, Matt wrote: > >Ok, Did some experimenting.... First of all, I decided to delete the OU..... Now >I am focusing only on editing the "Default Domain Policy"... In the AD structure >I have all the stations in the "Computers" folder, the server itself in the "Domain >Contollers" folder, and the users in the "Users" folder. > >Now... I am going to the domain "mattmontalto" and right clicking and going to properties, >- GP - and then "edit" (editing the default domain policy). > >From there i am going to "user config" and in the folder: Administrative Templates\Start >Menu & Taskbar, I am enabling something that would be a noticable command.... - such >as hiding the "Run" command from the start menu. > >Now... I manually refesh my user policy and log out & in the stations and the server.... >However, for some reason, the "run" command is only hidden on the Server's start >menu and NOT on any of the staions.--- So I left it for a couple hours and the logging >in on one of the stations again, and still no change. > >Pretty stumped at this point .... for some reason, the effects of the settings I >change are only appearing locally..... Is it possible that I need to be running some >type of login script for my users in order for their machines to be affected by the >changes I make?.. > >Once again.... Thanks for listening .... I really appreciate it.... [Reply or follow-up to this message] re: Login Hours Friday, February 15, 2002 at 5:21 am Posted by Matt (7 messages posted) Well I thank you anyway for all your time help & patience... I guess the only thing for me to do is keep messing around with it.... I accomplished getting a roaming profile set up, (set that up for the hell of it, to see if anything worked...) But, hey... be nice having some help in trying to figure this thing out.... If you can think of anything else, (and if its not too much of a bother), send me an email at matt@mattmontalto.com... - (fortunatly, me e-mail server has NO problems :) Thanks again for you time, help and patience.... Sincerely, Mattthew Montalto On Thursday, February 14, 2002 at 4:33 pm, Curt R wrote: > Well from the sounds of it, you're doing everything correctly and I'm at a loss >as to why it's not working. I wasn't able to lab this (lack of time) but I talked >it over with a friend and neither one of us can think of a reason why this isn't >working for you. I'm even more stumped after reading this post of yours. I've played >with things like removing the Run command many times and never encountered a problem. > Without being able to sit down at your DC and do some snooping around I really can't >think of what else I can do for your situation. > > >On Thursday, February 14, 2002 at 2:51 pm, Matt wrote: > > >Ok, Did some experimenting.... First of all, I decided to delete the OU..... Now >I am focusing only on editing the "Default Domain Policy"... In the AD structure >I have all the stations in the "Computers" folder, the server itself in the "Domain >Contollers" folder, and the users in the "Users" folder. > >Now... I am going to the domain "mattmontalto" and right clicking and going to properties, >- GP - and then "edit" (editing the default domain policy). > >From there i am going to "user config" and in the folder: Administrative Templates\Start >Menu & Taskbar, I am enabling something that would be a noticable command.... - >such >as hiding the "Run" command from the start menu. > >Now... I manually refesh my user policy and log out & in the stations and the server.... >However, for some reason, the "run" command is only hidden on the Server's start >menu and NOT on any of the staions.--- So I left it for a couple hours and the logging >in on one of the stations again, and still no change. > >Pretty stumped at this point .... for some reason, the effects of the settings I >change are only appearing locally..... Is it possible that I need to be running >some >type of login script for my users in order for their machines to be affected by >the >changes I make?.. > >Once again.... Thanks for listening .... I really appreciate it.... [Reply or follow-up to this message] Tip: Use one of the [Reply or follow-up to this message] links above to add a message to this thread Search this forum Start a new thread on a different subject Report abuse of the forum Return to the Windows 2000 Discussion Forum