Restricting Logon Hours for Active Directory Users

2.6K

By default, Active Directory users are allowed to log on to domain-joined devices at any time, 24 hours a day, 7 days a week. For security reasons, an administrator can restrict the time that users can log in to the domain to their work hours. This prevents users from logging at nights and weekends.

Note that Logon Hours restrictions apply to all AD authentications (including local workstation sign-ins, Remote Desktop sessions, and VPN-connected users that authenticate against AD).

Enabling logon time restriction from Active Directory Users and Computers console

You can enable the logon time restriction for a specific user from the Active Directory Users and Computers graphical console (dsa.msc).

1. Open the user properties in the ADUC console;
2. Go to the Account tab and click the Logon Hours button;

   

3. In the form that opens, you can specify the time intervals during which the user is allowed or denied from logging in to the domain. By default, the user can login anytime.
4. To prevent users from logging at specific intervals, select them and click Logon Denied. It is possible to select specific hours when logging in is allowed or denied. If you want to allow logins only during the user’s working hours, you can first deny logon during the whole week, and then select allowed hours and enable the Logon Permitted options for them.
   

   

In the resulting form, the color of the box indicates whether the user is allowed to login or not:

• Blue – user logon permitted
• White – logon denied

Keep in mind that Logon Hours restrictions are evaluated during authentication. In case a user signs in before the restricted period begins, they can usually continue working unless you configure additional policies to force logoff when logon hours expire.

Note. AD logon restrictions are set only by the hour, not by smaller increments such as the minute or quarter-hour. This means that if a user is allowed to log on from 9:00 AM to 7:00 PM, they cannot be restricted to specific minutes within that time.

How to Enable the Logon Hour Restrictions for Multiple User Accounts

1. Hold down the SHIFT key to select multiple users in the ADUC console. Press CTRL + click to add individual users.
2. Right-click the selected user group and select Properties.
3. Go to the Accounts tab, enable the Logon hours checkbox and configure the allowed and prohibited logon hours as described above.

How to Restrict Logon Hours via PowerShell

You can use PowerShell to manage the allowed/denied logon times of AD users. However, the problem, is that the value for allowed and denied logon hours is stored in the logonHours attribute as a 21-byte array. To decode this from/to value into an easy-to-read time format, you must use a fairly complex PowerShell script.

Therefore, it is easier to first configure the logon hours restrictions for one user from the GUI in the ADUC console, and then copy the logonHours attribute value to other users.

For example, the following PowerShell script copies the value of the logonHours attribute from user b.jackson and applies it to all users in the NyManagers AD security group:

$User = "b.jackson"

$groupName = "NyManagers"

$LogonHours = (Get-ADUser -Identity $User -Properties logonHours).logonHours

Get-ADGroupMember -Identity $groupName |
    Where-Object {$_.objectClass -eq 'user'} |
    ForEach-Object {
        Set-ADUser -Identity $_ -Replace @{logonHours = $LogonHours}
    }

Note. In case the target group contains nested groups, computers, or contacts, you should filter the results of Get-ADGroupMember to user objects only before applying the logonHours attribute.

Now, when a user tries to log on to any domain computer outside of the permitted hours, after entering the password, the following message appears on the logon screen:

Your account has time restrictions that prevent you from signing in at this time. Please try again later.

There are several GPO settings that allow you to automatically disconnect users when their logon time expires.

Open the GPO editor and navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options. Configure following polices:

• Enabled the Microsoft network server: Disconnect clients when logon hours expire.
• Network security: Force logoff when logon hours expire.

Then enable the policy Set Action to Take When the Logon Time Ends under User Configuration > Administrative Policies > Templates > Windows Components > Windows Logon Options. Select Logoff as the action to take when the logon hours expire.

User work time restrictions improve domain protection from attackers who cannot access the domain when no one is supposed to be in the office.

Wrapping up

So, Logon Hours restrictions provide a simple way to limit when users can authenticate to AD. They are commonly used for contractors, temporary accounts, kiosk users, and high-security environments. For large deployments, you should config the schedule once in ADUC and distribute the logonHours attribute with PowerShell. If users must be disconnected when their allowed time expires, you need to combine Logon Hours with the appropriate security policies that force logoff.