Restricting Logon Hours for Active Directory Users

2.7K

By default, Active Directory users are allowed to log on to domain-joined devices at any time, 24 hours a day, 7 days a week. For security reasons, an administrator can restrict the time that users can log in to the domain to their work hours. This prevents users from logging at nights and weekends.

Note that Logon Hours restrictions apply to all AD authentications (including local workstation sign-ins, Remote Desktop sessions, and VPN-connected users that authenticate against AD).

Enabling logon time restriction from Active Directory Users and Computers console

You can enable the logon time restriction for a specific user from the Active Directory Users and Computers graphical console (dsa.msc).

1. Open the user properties in the ADUC console;
2. Go to the Account tab and click the Logon Hours button;

   

3. In the form that opens, you can specify the time intervals during which the user is allowed or denied from logging in to the domain. By default, the user can login anytime.
4. To prevent users from logging at specific intervals, select them and click Logon Denied. It is possible to select specific hours when logging in is allowed or denied. If you want to allow logins only during the user’s working hours, you can first deny logon during the whole week, and then select allowed hours and enable the Logon Permitted options for them.
   

   

In the resulting form, the color of the box indicates whether the user is allowed to login or not:

• Blue – user logon permitted
• White – logon denied

Keep in mind that Logon Hours restrictions are evaluated during authentication. In case a user signs in before the restricted period begins, they can usually continue working unless you configure additional policies to force logoff when logon hours expire.

Note. AD logon restrictions are set only by the hour, not by smaller increments such as the minute or quarter-hour. This means that if a user is allowed to log on from 9:00 AM to 7:00 PM, they cannot be restricted to specific minutes within that time.

How to Enable the Logon Hour Restrictions for Multiple User Accounts

1. Hold down the SHIFT key to select multiple users in the ADUC console. Press CTRL + click to add individual users.
2. Right-click the selected user group and select Properties.
3. Go to the Accounts tab, enable the Logon hours checkbox and configure the allowed and prohibited logon hours as described above.

How to Restrict Logon Hours via PowerShell

You can use PowerShell to manage the allowed/denied logon times of AD users. However, the problem, is that the value for allowed and denied logon hours is stored in the logonHours attribute as a 21-byte array. To decode this from/to value into an easy-to-read time format, you must use a fairly complex PowerShell script.

Important. The logonHours attribute is stored in AD as a UTC/GMT-based 21-byte bitmask. Active Directory Users and Computers converts the values to the local time zone when displaying the Logon Hours dialog.

This is important when configuring logon hours programmatically. If you manually construct/decode the logonHours byte array, you must account for the time-zone conversion. Otherwise, the resulting schedule may not correspond to the intended local working hours.

Time zone and DST considerations. Because logonHours is stored in UTC, the same byte array can be displayed as different local times on machines configured with different time zones. This is particularly important in organizations with users/admins working across multiple time zones.

Daylight saving time can also affect how a fixed UTC schedule corresponds to local time. If you need a schedule to consistently represent specific local working hours throughout the year, you should test the config after DST transitions.

Therefore, it is easier to first configure the logon hours restrictions for one user from the GUI in the ADUC console, and then copy the logonHours attribute value to other users.

For example, the following PowerShell script copies the value of the logonHours attribute from user b.jackson and applies it to all users in the NyManagers AD security group:

Note. The script below copies an existing logonHours value as-is. It does not convert the schedule between time zones. You should use this approach when the source and target users should have the same UTC-based logon schedule. For users in different time zones who require the same local working hours, you need to calculate a separate logonHours value for each time zone.

$SourceUser = "b.jackson"

$GroupName = "NyManagers"

$SourceUserObject = Get-ADUser -Identity $SourceUser -Properties logonHours

if (-not $SourceUserObject.logonHours) {
    throw "The source user '$SourceUser' does not have a logonHours value configured."
}

$LogonHours = $SourceUserObject.logonHours

Get-ADGroupMember -Identity $groupName -Recursive |
    Where-Object {$_.objectClass -eq 'user'} |
    ForEach-Object {
        Set-ADUser -Identity $_ -Replace @{logonHours = $LogonHours}
    }

Note. The -Recursive parameter includes users from nested groups. The Where-Object filter ensures that only user objects are passed to Set-ADUser. Without -Recursive, users who are members of nested groups are not returned.

Because this script copies the existing logonHours byte array without converting/reconstructing it, the target users receive exactly the same AD value as the source user. This avoids introducing an additional time-zone conversion during the copy operation.

However, this also means that the copied schedule represents the same UTC-based schedule. If the source and target users are expected to follow different local working hours because they are in different time zones, you should not simply copy the attribute value; instead, calculate the required logonHours value for the target time zone.

Note. In case the target group contains nested groups, computers, or contacts, you should filter the results of Get-ADGroupMember to user objects only before applying the logonHours attribute.

Now, when a user tries to log on to any domain computer outside of the permitted hours, after entering the password, the following message appears on the logon screen:

Your account has time restrictions that prevent you from signing in at this time. Please try again later.

Logon Hours restrictions and session termination are controlled by different Windows policies. The SMB-related policies can terminate network file-sharing sessions when a user’s allowed logon time expires, while a separate Windows Logon Options policy controls what happens to an active interactive or Remote Desktop session.

Open the GPO editor and navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options. Configure the following policies depending on which type of session you want to control:

• Microsoft network server: Disconnect clients when logon hours expire — disconnects SMB client sessions when the user’s allowed logon hours expire.
• Network security: Force logoff when logon hours expire — also affects the SMB component and forces established SMB client sessions to be disconnected when logon hours expire.
• Set Action to Take When the Logon Time Ends — controls the action taken on the user’s active Windows session when the allowed logon time expires. Depending on the config, Windows can Lock, Disconnect, or Logoff the session.

Important. The SMB-related policies above do not replace the Windows Logon Options policy for interactive session termination. Network security: Force logoff when logon hours expire affects SMB sessions; it does not perform an interactive Windows logoff of the user session. If your goal is to automatically sign out users from their workstation/Remote Desktop session when their allowed logon hours expire, you need to config Set Action to Take When the Logon Time Ends and select Logoff.

To automatically terminate an active Windows user session when the allowed logon time expires, you need to enable Set Action to Take When the Logon Time Ends under User Configuration > Administrative Templates > Windows Components > Windows Logon Options.

Select Logoff if you want Windows to sign the user out when the allowed logon hours expire. The policy can also be configured to Lock/Disconnect the session instead.

User work time restrictions improve domain protection from attackers who cannot access the domain when no one is supposed to be in the office.

Wrapping up

So, Logon Hours restrictions provide a simple way to limit when users can authenticate to AD. They are commonly used for contractors, temporary accounts, kiosk users, and high-security environments.

For large deployments where users share the same logon-hours schedule, you can config the schedule once in ADUC and distribute the resulting logonHours attribute with PowerShell.

Keep in mind that logonHours is stored as a UTC-based bitmask, so users in different time zones may require different values if the intended schedule is based on their local time. If users must be signed out when their allowed time expires, you need to config Set Action to Take When the Logon Time Ends and select Logoff. If you also need to terminate SMB file-sharing sessions, you need to config the appropriate SMB-related logon-hours policies.