Managing user access is an important part of maintaining a secure Windows network. In an organization, employees, contractors, and other users may need access to company computers and network resources during specific working hours. However, allowing everyone to sign in at any time can create unnecessary security risks and make account management more difficult.
This is where Active Directory (AD) logon hours come in handy. Windows Server provides an option that allows administrators to specify when a particular domain user account can log on to the network. For example, if employees are only supposed to access company resources between 8 AM and 6 PM, an administrator can configure the account’s logon schedule accordingly.
The feature is particularly useful for organizations that want to manage employee access, enforce working schedules, and reduce opportunities for unauthorized account usage outside approved hours.
In this guide, we’ll explain how to restrict logon hours for Active Directory users, configure the appropriate schedule, apply the settings, and troubleshoot common problems.
Let’s get started.
Restricting Logon Hours for Active Directory Users in Windows
To restrict logon hours for an Active Directory user, follow these steps:
- Sign in to a domain controller or administrative workstation using an account with the required permissions.
- Open Active Directory Users and Computers by searching for dsa.msc in the Run dialog box.
- To select the appropriate account, expand your domain and open the organizational unit containing the user.
- Right-click the user account and select Properties.
- Open the Account tab and select Logon Hours.
- Highlight the hours when the user should be allowed to sign in and select Logon Denied for the remaining periods.
- Click OK to save the schedule and apply the changes.
- Test the configuration using the user’s account and review the results.
1: Sign In With an Account That Has Administrative Permissions
Before changing logon hours, make sure you have the appropriate permissions to manage Active Directory user accounts. You generally need delegated permissions to modify the target user’s account properties. Domain Admin membership is not always necessary if your organization has configured appropriate administrative delegation.
Start by signing in to a domain-joined Windows computer or domain controller using an authorized administrative account. Make sure the computer can communicate with your organization’s domain controller.
If you are working remotely, connect to the corporate network or an approved VPN so that your computer can access Active Directory.
It is also a good idea to confirm which user account you need to modify. Restricting the wrong account could prevent an employee from accessing company resources during normal business hours.
Use this general access path: Windows sign-in > Administrative account > Domain-connected computer > Active Directory management.
Once you have confirmed your permissions and network connectivity, you can open the Active Directory management console.
2: Open Active Directory Users and Computers
The next step is to open Active Directory Users and Computers (ADUC). This Microsoft management console allows administrators to manage domain users, groups, computers, and organizational units.
Press Windows + R on your keyboard to open the Run dialog box. Type dsa.msc and press Enter. The Active Directory Users and Computers console should appear.
If Windows cannot find the command, check whether the Active Directory Domain Services management tools or Remote Server Administration Tools (RSAT) are installed. On supported Windows client editions, you can install the required AD management tools through Windows Optional Features.
After opening the console, locate your organization’s domain in the left navigation panel. Expand it to view the available containers and organizational units.
Follow this path: Windows + R > dsa.msc > Active Directory Users and Computers > Your Domain.
You should now have access to the directory structure where your organization’s user accounts are stored.
3: Locate the User Account You Want to Restrict
Once ADUC is open, find the specific domain user account whose logon hours you want to modify.
Expand your domain and navigate to the organizational unit (OU) containing the account. For example, your company might organize accounts into separate OUs named Employees, Contractors, IT Department, and Sales Department.
If you are unsure where the account is located, right-click your domain and use the Find option. Enter the user’s name or username and start the search.
When the correct account appears, double-check its username and other identifying details before making any changes. This is especially important in large organizations where multiple employees may have similar names.
The navigation path is Active Directory Users and Computers > Domain > Organizational Unit > User Account.
After locating the correct account, you can open its properties and configure the permitted sign-in schedule.
4: Configure the Allowed Logon Hours
Now that you have opened the correct user account, you can configure the hours when the user is permitted to sign in.
Right-click the account and select Properties. In the Properties window, open the Account tab. Look for the Logon Hours button and select it to open the weekly scheduling window.
You will see a grid representing the seven days of the week, divided into hourly time slots. Each box represents a specific period during which the user can or cannot log on.
For example, suppose your organization allows employees to sign in Monday through Friday between 8 AM and 6 PM. You can select the permitted time slots for those days and deny access during the remaining hours.
To configure the schedule, select the time slots you want to restrict and click Logon Denied. Then select the hours when the user should be permitted to sign in and click Logon Permitted.
Follow this path: User Properties > Account > Logon Hours > Select Time Slots > Logon Permitted or Logon Denied.
Pay close attention to the day and time boundaries. If an employee works overnight or across different shifts, configure the schedule carefully so that the permitted hours cover the correct days.
Also, consider the time zone used by your domain environment. Logon-hour restrictions are stored in Active Directory as weekly time intervals, so verify the displayed schedule against the actual working hours before applying it.
5: Save and Apply the Logon Hour Restrictions
After configuring the weekly schedule, review the selected time slots one more time. Make sure you have allowed access during the employee’s approved working hours and denied access during the periods when sign-in should not be permitted.
Once everything looks correct, click OK to close the Logon Hours window. Then click Apply and OK in the user’s Properties window to save the changes.
The updated schedule is stored in the user’s Active Directory account through the logonHours attribute.
Follow this path: Logon Hours > OK > Apply > OK.
Keep in mind that Active Directory replication may affect how quickly the updated settings become available across domain controllers. If your organization has multiple domain controllers, allow sufficient time for replication before troubleshooting a restriction that appears not to work.
You should also document the change according to your organization’s account management procedures. This is especially useful when administrators manage logon schedules for multiple departments or employee groups.
6: Configure What Happens When Logon Hours Expire
There is one important detail that many administrators overlook. Restricting logon hours does not necessarily terminate a session that a user already established during an allowed period.
For example, suppose an employee signs in at 5:30 PM and their permitted logon hours end at 6 PM. The user may be able to continue using an existing session after 6 PM unless additional security policies are configured.
If you want to enforce restrictions on existing sessions, review the relevant Group Policy settings.
Open Group Policy Management by running gpmc.msc. Edit the appropriate Group Policy Object (GPO) and navigate to:
Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options.
Look for Microsoft network server: Disconnect clients when logon hours expire. Enabling this setting disconnects existing SMB client sessions when their permitted hours expire.
For broader user-session enforcement, also review the Set action to take when logon hours expire policy under:
User Configuration > Policies > Administrative Templates > System > Windows Logon Options.
Depending on the available configuration, you can choose to lock the workstation, disconnect the user, or log the user off. Be careful with forced logoff because employees may lose unsaved work.
7: Test the Logon Restrictions
After saving the configuration, test the account to make sure the restrictions work as expected. Testing is particularly important if you are applying the same schedule to several employees.
Use an authorized test account with a schedule similar to the one you configured. Attempt to sign in during an allowed period and confirm that access is successful. Then test during a denied period using an appropriate test environment.
If the restriction does not appear to work, check whether the user is authenticating against the expected domain controller and whether the updated account information has replicated.
You can also review the account’s properties again to confirm that the correct time slots remain selected.
Follow this path: Active Directory Users and Computers > User Account > Properties > Account > Logon Hours.
Do not use a real employee’s account for disruptive testing without approval. A dedicated test account makes it easier to verify the settings without interrupting normal business operations.
FAQs
1. Can I restrict Active Directory users to specific working hours?
Yes. Active Directory allows administrators to configure specific days and time periods when a domain user can log on. You can configure this through the Logon Hours option in the user’s Account properties.
2. Does restricting logon hours automatically log off users?
No. Restricting logon hours primarily prevents new logons outside permitted periods. Existing sessions may continue unless you configure additional policies to lock, disconnect, or log off users when their permitted hours expire.
3. Can I configure different logon hours for different users?
Yes. You can configure individual schedules for different domain user accounts. For example, you can allow regular employees to sign in during standard business hours while assigning contractors a more limited schedule.
4. Can I restrict logon hours using PowerShell?
Yes. You can manage Active Directory account properties using PowerShell and the Active Directory module. However, configuring the weekly logonHours attribute directly requires handling its binary time representation correctly. For beginners, ADUC is generally easier to use.
5. What happens when a user tries to log on outside permitted hours?
The domain authentication process checks the user’s permitted logon schedule. If the attempted logon falls outside the allowed period, authentication is denied.
6. Can I remove logon hour restrictions later?
Yes. Open the user’s Properties window, navigate to Account > Logon Hours, select all time slots, and click Logon Permitted. Save the changes to allow logons throughout the week.
7. Do logon hour restrictions apply to remote desktop connections?
They can affect domain authentication for Remote Desktop logons, but the exact behavior depends on the authentication method and connection configuration.
Test your Remote Desktop environment separately and use additional access controls where necessary.