Setting a users logon hours
By default a user can logon 24/7. Is this acceptable – should users be able to logon during the night or weekends. AD Users and Computers has a GUI to set the hours users can logon. But we don’t need a GUI we can do this
if (-not (Get-Module ActiveDirectory)){
Import-Module ActiveDirectory
}
$ou = "OU=England,DC=Manticore,DC=org"
## allow logon 8am - 6pm Monday to Friday
[byte[]]$hours = @(0,0,0,0,255,3,0,255,3,0,255,3,0,255,3,0,255,3,0,0,0)
"`nMicrosoft"
$name = "UserA"
Get-ADUser -Identity $name |
Set-ADUser -Replace @{logonhours = $hours}
"`nAD provider"
$name = "UserB"
$dn = "cn=$name,$ou"
Set-ItemProperty -Path AD:\$dn -Name logonhours -Value $hours -Force
"`nQuest"
$name = "UserC"
Get-QADUser -Identity $name |
Set-QADUser -ObjectAttributes @{logonhours = $hours}
"`nScript"
$name = "UserD"
$dn = "cn=$name,$ou"
$user = [adsi]"LDAP://$dn"
$user.logonhours[0] = $hours
$user.SetInfo()
We’ll use the four test users we created earlier in the England OU.
The important point is how we represent the hours users can logon.
The information is stored as a byte array – 3bytes per day with 1 bit per hour
We want to restrict the users to 8am-6pm Monday to Friday so we use
[byte[]]$hours = @(0,0,0,0,255,3,0,255,3,0,255,3,0,255,3,0,255,3,0,0,0)
Sunday is the start of the week – no logons allowed so first three bytes are 0. Monday’s three bytes starts with a 0 as don’t want logons between midnight and 8am. The 8 hours of logons followed by two hours. etc
A few other examples might help
Deny all logon
[byte[]]$hours = @(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)
Allow logon at all hours
[byte[]]$hours = @(255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255)
Allow 8am-6pm – 7 days a week
[byte[]]$hours = @(0,255,3,0,255,3,0,255,3,0,255,3,0,255,3,0,255,3,0,255,3)
If you are in doubt about generating the array – set in the GUI then copy the values using ADSIEdit
The scripts are straightforward – the cmdlets get the user and pipe to set. The difference is the parameter we use
The provider uses Set-Itemproperty and the only oddity in the script is we use logonhours[0] as the property. This forces acceptance of the byte array