NT gives the administrator the capability to limit a user to a specific workstation by defining a workstation restriction on the user account's properties in User Manager for Domains, but this restriction limits the user to a specific workstation instead of limiting the number of concurrent logons. A fairly common question on NT newsgroups is "How can I prevent users from logging onto multiple workstations simultaneously?" This capability comes with Novell Netware. Guess who asks how to do this in NT?

The 3rd party commercial product UserLock offers this addon capability. UserLock functionality:

• Installed only on the domain controller
• Limits the number of simultaneous connections under the same username on the entire Windows NT network.
• Tracks the activity on the event log of PDC
• Manages single and multi-domain networks
• restrains simultaneous connections on all computers with Windows 3.x, 9x and NT.
• Tracks the activity on the event log of PDC

Microsoft has included the Concurrent Connection Limiter (Cconnect) utility with Windows 2000 Server Resource Kit. Cconnect lets you limit concurrent logons in both Windows 2000 and NT4 domains but as you will see, it best fits a pure W2K pure environment but it can be made to work in an NT environment.

Cconnect has an administrator and client component. Cconnect Administrator lets the administrator view current logons across the domain and forcibly log off users when considered necessary. Cconnect Client is installed on each workstation and enforces the concurrent logon restriction. When a user logs on to a workstation, Cconnect Client counts the number of currently active logons for that user in a SQL Server database, then compares that number to the maximum number you've allowed for that user. If the user has exceeded the limit, Cconnect immediately logs the user off.

Note the need for a sql db. To use Cconnect, you set up a new database and user account on an SQL Server. To centrally manage all the instances of Cconnect Client, you import new Windows 2000 Group Policies or NT system policies. These policies, in the cconnect.adm file, define registry values for the HKEY_CURRENT_ USER\Software\Microsoft\Cconnect subkey. The registry entries define the connection to the sql db and set the number of allowed simultaneous connections. The Cconnect Client is found in the \apps \cconnect\client directory of the W2K Server Resource Kit. To install Cconnect Administrator, run setup.exe from the \apps\cconnect\administrator directory.

If the only Cconnect function you require is concurrent logon restrictions and you're running W2K on the desktop in a AD environment, you can add calls to cconnect.vbs and cclogoff.vbs to the user's logon and logoff scripts. You can deploy Cconnect throughout your W2K domain without ever touching a workstation if you define your logon scripts in Group Policy under

• User Configuration
• Windows Settings
• Scripts

Cconnect is a Microsoft resource kit utility and has severe limitations when compared to commercial products. But of course the price is right if you own the W2K Server Resource Kit. Cconnect deletes active logon records from the sql db only when a user logs off correctly. This means that a user can be improperly denied logon. To fix the problem, you must use Cconnect Administrator to manually delete the old logon record. Since the number of simultaneous logons is a registry entry on the workstation, it can be circumvented by hacking the registry. A real problem is Cconnects lack of security considerations in its design. Cconnect Client stores SQL Server user and password data in clear text in the registry. By default, this account has sa privileges. If you understand this, the account's privileges can be restricted. This is not a realistic expectation. From a hacker's perspective, Cconnect installed with defaults, is a hacker's pathway to gaining elevated privileges to the sql server. If you are going to use it, get a dba to restrict the account used by Cconnect to only the tables required. If you use Cconnect on NT workstations, you will have to install some W2K-like requirements: windows scripting host, web-based enterprise management and mdac. OK, OK - there is no free lunch. After all it IS a utility in the W2K Server Resource Kit, not the Windows NT Server Resource Kit. If you have the cash, consider UserLock.