Limiting Concurrent Logins in Windows NT/2000

Network security is a critical issue for most companies today. As part of a Defense-In-Depth security infrastructure for a company, it is vital that an administrator be aware of what is happening on their network and what their users are doing. User logon consisting of a username and password is the basis for security on virtually all network operating systems in use today. Novell Netware has had the capability for years (since version 3.X) to limit concurrent user logins that will prevent a user from logging onto more that one workstation simultaneously. For unknown reasons, this capability has never been included with Windows NT Server or Windows 2000 Server. Windows NT/2000 does provide the capability to limit a users login to a specific workstation by defining a workstation restriction based on the workstations MAC address. This is done through the user account's properties in User Manager for Domains (Windows NT) and , but this restriction is very limiting in an Enterprise environment where a user would need the capability to login to any workstation. This document intends to research, evaluate and recommend solutions for overcoming the inability of Windows NT/2000 Server environments to limit concurrent user logins.