### Previous Attempts to Restrict Student Logins
I once thought about restricting students from turning on their computers, but it didn't work out in the end. Who has the time to sit there doing that every day? Ugh, computer labs without internet are really a hassle.
### Password Change Plan
Our new master disk has two sets of accounts built into each system:
- Username: Administrator, Password: onlyedu, for system management
- Username: Onlyit, Password: empty, for student teaching
This password change plan involves, during break time, the teacher's computer using psexec to remotely execute password changes on all student computers and then lock the student terminals. Students need to go to the office to get the password to log in when they need to use the computer.
Here's a simple example:
**Change Student End Password.cmd**
-----------------------------
for /f "tokens=1,2 delims=/ " %%a in (password.txt) do @psexec \\%%a -u administrator -p onlyedu –c -d run.cmd %%b
-----------------------------
**Run.cmd**
--------------------------------
net user onlyit "%1"
%windir%\System32\rundll32.exe user32.dll,LockWorkStation
----------------------------------
**Password.txt**
------------------------------
192.168.1.3/123456
192.168.1.8/fsdaf
-------------------------------
We use the for syntax to separate the IP part (%a) and the new password part (%b) from the password file password.txt using the "/" delimiter. Then, psexec is used to remotely upload run.cmd to the student terminal to execute `net user onlyit "%1"`, where %1 is the parameter passed from %b. Then, the rundll32 command is used to lock the student terminal. If they want to use the computer, they need to go to the office to get the password.
To avoid file processing troubles, the password.txt should have the IP followed immediately by "/" and then the continuous password, with no blanks. For example, the following are incorrect: one has a space in the password and the other has a blank at the end of the password.
192.168.1.3/12 21
192.168.1.3/12
**Other Notes**
1. Ensure network connectivity; disable the network card or use automatic IP configuration.
2. Remove permissions for lusrmgr.msc, nusrmgr.msc, and corresponding programs for creating new users for the onlyit user.
3. Configure a script to automatically delete any new users created by students.
This is just a simple plan implementation; more details need to be summarized during implementation.
### Scheduled Shutdown Plan
Let's talk about the feasibility of forced scheduled shutdown. I classify this document as top secret, not because it's very sophisticated, but because it's like the saying "once you reveal it, it's not valuable anymore." Because in the earlier attempt to block the Warcraft game using the firewall, some students enabled registry entries and stopped the Windows firewall, making the method ineffective. The scheduled task we're using this time is also an easily bypassed method, so we shouldn't tell anyone else how we implement it unless necessary.
Our steps are: ensure the scheduled task runs during user login, quietly synchronize the system time during class, force a shutdown from 17:15 to 18:15, and allow normal boot in other periods.
1. **Ensure Scheduled Task Service is Running**
First, we load Bschedule.cmd in the group policy user login settings to ensure the scheduled task is running.
**Bschedule.cmd**
---------------------------------
%systemroot%\system32\sc.exe config Schedule start= AUTO
%systemroot%\system32\sc.exe start Schedule
----------------------------------
2. **Common Scheduled Task Types**
MINUTE, minute
HOURLY, hourly
DAILY, daily
WEEKLY, weekly
MONTHLY, monthly
ONCE, once
ONSTART, at startup
ONLOGON, when user logs on
ONIDLE. when idle
3. **Synchronize System Time**
Autosyntime.cmd is used to create an ONIDLE type scheduled task. If necessary, remove the permission for all student computers to change the time. Then, as long as the network is connected, as long as the teacher's computer time is calibrated, all computers will automatically synchronize with the teacher's computer time.
---------------------------------------
SCHTASKS /delete /tn autosyntime /f
SCHTASKS /create /RU onlyit /RP "" /SC ONIDLE /I 1 /TN autosyntime /TR "c:\windows\system32\net.exe time \\teacher /set /y"
-------------------------------------------
4. **Force Shutdown from 17:15 to 18:15**
In the most ideal test method, a plan task of ONLOGON type is generated at 17:15, so that as soon as the user logs in, it will immediately log off. But this method has several drawbacks:
a. It must log in as a user (onlyit).
b. Cannot implement NTFS permissions to achieve hiding in the control panel.
c. Since it's an ONLOGON type, in a single-machine environment, another plan to delete it every minute from 18:16 today to 17:14 tomorrow is needed to ensure normal login. So we give up.
In actual testing, we originally wanted to use the logoff method because in an emergency, the computer is still at the welcome screen and we have other methods to cancel the scheduled task. But the tested shutdown, rundll32, logou and other programs can only be executed normally in the current user state, which means we must use the current logged-in user's account to execute the scheduled task, and we can't control the accounts that students create themselves. So we temporarily use shutdown –s –t 900 –c "Shutdown".
**Forcelogout.cmd** The command line parameters in XP don't meet our needs. The schtasks in XP doesn't support the /ET parameter setting for duration in 2003. Then we can only implement it by copying. So we set a scheduled task named forcelogout that will execute shutdown every minute starting at 17:15:00 every day.
--------------------------
SCHTASKS /delete /tn forcelogout /f
SCHTASKS /create /RU "" /RP onlyedu /SC MINUTE /MO 1 /TN forcelogout /TR " shutdown –s –t 900 –c "Shutdown"" /ST 17:15:00 /SD 2000/01/01
---------------------------
5. **Strengthen Security Settings**
a. Scheduled task service is stopped ^In this case, it can only be ensured remotely through psexec.
b. System time is incorrect (in single-machine case) ^Troublesome, probably only adjusting BIOS time settings.
c. control schedtasks advanced/view log ^hidlog.cmd, deny onlyit user access to scheduled task log
----------------------------------------
sc stop schedule
REM Ping for delay processing to ensure service stops correctly
ping -l -n 4 127.0.0.1>nul
del %systemroot%\schedlgu.txt /q
REM The following two steps ensure schedlgu.txt is generated
sc start schedule
sc stop schedule
REM Then set permissions for schedlgu.txt to deny current user onlyit access
cacls %systemroot%\schedlgu.txt /e /d onlyit
sc start schedule
---------------------------------------------------
d. Forbid viewing scheduled tasks in remote computer shares ^hideschtasks.reg.
---------
Windows Registry Editor Version 5.00
---------
e. Forbid onlyit user access to schtasks command
cacls %systemroot%\system32\schtasks.exe /e /d onlyit
f. Forbid onlyit account from viewing scheduled task settings, which can hide it in the control panel
cacls %systemroot%\tasks\autosyntime.job /e /d onlyit
Let's stop here for now. Everyone also needs to consider how to handle cases like 105 being normal usually but needing to be solved from 13:00 to 21:00 on Sunday, and how to unlock in case of sudden events.
### Better Logoff Plan
The earlier forced offline plan has many inoperable aspects due to shutdown. Its -s forced shutdown can be executed under all users, but if an emergency occurs, even the administrator can't cancel it, and its -l forced logoff also needs to be executed under the logged-in user's account.
This time we use the net user /times parameter to set the user's login time:
net user onlyit "" /times:monday-friday,8AM-5PM,6PM-10PM;saturday-sunday,8AM-10PM
Allowed login hours:
- Sunday: 08:00 AM - 10:00 PM
- Monday: 08:00 AM - 05:00 PM, 06:00 PM - 10:00 PM
- Tuesday: 08:00 AM - 05:00 PM, 06:00 PM - 10:00 PM
- Wednesday: 08:00 AM - 05:00 PM, 06:00 PM - 10:00 PM
- Thursday: 08:00 AM - 05:00 PM, 06:00 PM - 10:00 PM
- Friday: 08:00 AM - 05:00 PM, 06:00 PM - 10:00 PM
- Saturday: 08:00 AM - 10:00 PM
In this way, we have set the specific login periods for the onlyit user each day. For example, on Monday, the user can log in from 08:00 to 17:00 during class time. Then, as long as the user doesn't log off, the student can still use the computer normally after 17:00. Then we need to run a scheduled task at 17:15.
**Lock_workstation.cmd** Lock the console, so that from 17:00 to 18:00, the user can't log in.
SCHTASKS /delete /tn Lock_workstation /f
SCHTASKS /create /RU "" /RP onlyedu /SC MINUTE /MO 1 /TN Lock_workstation /TR "%windir%\System32\rundll32.exe user32.dll,LockWorkStation" /ST 17:15:00 /SD 2000/01/01
The advantage of this compared to the earlier shutdown –l plan is that in this state, we can keep the student's work, but unlocking still requires using psexec to remotely change the time.
### Reference Document
Skillfully Use the net user Command to Restrict User Login to the Computer
