Unable to lock students out of their computers at midnight

Question

Hi Experts. I'm the IT Coordinator at a small private school. Here's the problem I'm facing:

Students are staying on their Surfaces at home past midnight (gaming or whatever). We would like to disconnect them at midnight and lock the account till morning.

I know I can do this in Active Directory, but unfortunately the logon hours attribute doesn’t get cached onto their machines and since they aren’t connected to our network at night it doesn’t enforce.

Any ideas in Windows Server or other software would be helpful.

Thanks.

Answer 1

How are they performing in their classes? If they are performing well then what business is it of yours what they do with their time? Would you prefer that they go to bars instead?

I am concerned about the whatever part. Are these devices they have been provided for academic purposes? Do they use them past midnight for academic purposes? If so then do you really want to lock them out of doing that? If these are devices provided by the school for academic purposes then it seems reasonable that they be used for that purpose. Perhaps the solution is to install a policy that limits what software they can install (or perhaps can be used during certain times) instead of locking them out of the entire device. But if they perform well in school and don't get drunk and behave themselves reasonably well then you need to let them decide what they do.

Answer 2

It might be a bit mean-spirited, but this should work:

# QUSER output looks like this:
# USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
#>user                 console             7  Active      16:40  7/20/2021 9:46 AM

quser |
    Select-Object -Skip 1 |
        ForEach-Object{
            $SessionID = ($_ -split ' +')[2]
            logoff $SessionID
        }

Run it a a scheduled task.

If the user account is prevented from logging in by the Active Directory hours, that would keep them off your LAN. They'd still be able to log on to their machines, though.

Answer 3

Hi,

We may consider the schedule task method to shut down the workstation.

1, Deploy a schedule task GPO to shut down the server.
Make sure the workstation applies the policy when connect to the domain.
Even the workstation disconnected at midnight, the system will still shut down the server.
Steps:
Create a GPO and configure the task schedule under computer configuration




2, If you don't want the users to logon the station again when disconnected from the domain, we can configure the following policy:
Interactive logon: Number of previous logons to cache (in case domain controller is not available)
Location
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
Value:0(once apply this policy, no credentials will be cached on the workstations, and users can't logon when disconnected from the domain).

Best Regards,