I have a Windows Server 2012 server that allows remote desktop users (sessions are hosted on the server itself). I'm trying to enforce logon hours for these remote desktop users.
I have specified logon hours for a user and confirmed that they work--they aren't allowed to logon when logon hours are disabled. However, they are allowed to continue a session past their logon hours limit if they are already signed in (which is fine, this is the default behavior).
However, when I try to use the `Set action to take when logon hours expire` option (`User Configuration/Administrative Templates/Windows Components/Windows Logon Options/Set action to take when logon hours expire`), and set the behavior to "Logoff", nothing happens--the user can continue their session happily. I've tried applying this policy both for the user's group and for the local computer. I've run `gpresult` for the user and confirmed that the policy is apparently in place.
I also naively tried the "Force logoff when logon hours expire" option, but that apparently doesn't apply to interactive logins (confusing!).
Am I misapplying this setting, or do I need to take some other steps to get it to work? I'd be grateful for any input. Thanks!
I have specified logon hours for a user and confirmed that they work--they aren't allowed to logon when logon hours are disabled. However, they are allowed to continue a session past their logon hours limit if they are already signed in (which is fine, this is the default behavior).
However, when I try to use the `Set action to take when logon hours expire` option (`User Configuration/Administrative Templates/Windows Components/Windows Logon Options/Set action to take when logon hours expire`), and set the behavior to "Logoff", nothing happens--the user can continue their session happily. I've tried applying this policy both for the user's group and for the local computer. I've run `gpresult` for the user and confirmed that the policy is apparently in place.
I also naively tried the "Force logoff when logon hours expire" option, but that apparently doesn't apply to interactive logins (confusing!).
Am I misapplying this setting, or do I need to take some other steps to get it to work? I'd be grateful for any input. Thanks!