Limit to one Login session

[Ob1]

I am trying to figure out how to setup a domain that i manage so i can limit users to one login session at a time. what i mean is if user A logs in to his workstation and then walks to another workstation and trys to login on that one with the same username and password he used on the first workstation i want the server to deny that login until he logs out of his original workstation.

Is there a group policy setting that enables this feature? or is it something in AD Users/computers?

i have briefly looked in GPMC but did not find anything that matched the "limit user to one login session".

this is a domain environment running all windows xp machines and one windows server 2003 with.

any suggestions would be appreciated....

[doctorgonzo]

See this: http://forums.speedguide.net/showthread.php?t=192670. It looks like AD doesn't have this feature, which is pretty stupid. Novell Netware (which I use) has a very simple "Allow X simultaneous logins" that does exactly this.

[Ob1]

yeah i knew novell had this feature. i have worked on a few novell networks before that use the "allow x simultaneous logins". seems like a great security feature to me.

thanks for the link.

so there is no group policy setting that i can enable that will do this as well?

[doctorgonzo]

Nope, it doesn't look like there's anything in the Group Policy editor for this.

It may be possible to implement this using scripts. For example, upon login, an empty text file (essentially a cookie) would be placed in the user's directory. The login script would be written to test to see if this file exists; if it does, it means that the user is already logged in and the login would be aborted. Upon logoff, if the file exists it would be deleted. It's crude but it might work.