You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Lounge » OT update groupmembership of logged on user
Register User       Forum List       Calendar       FAQ
Page 1 of 1 1
Topic Options
#176391 - 2007-05-22 07:18 PM OT update groupmembership of logged on user
pvds Offline
Hey THIS is FUN
*****

Registered: 2001-04-14
Posts: 201
Hi,

When I remove a already logged on user from a security group the user can still access the resources for this security group. After a logoff and a logon it is working as expected.
How can I make it work without al logoff and logon

Peter
Top
#176392 - 2007-05-22 08:40 PM Re: OT update groupmembership of logged on user [Re: pvds]
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
Hi,

Basically you can't. The user still has the security token it got when he logged in. It only changes the next time he logs in.
Top
#176394 - 2007-05-22 09:15 PM Re: OT update groupmembership of logged on user [Re: Arend_]
pvds Offline
Hey THIS is FUN
*****

Registered: 2001-04-14
Posts: 201
 Originally Posted By: apronk
Hi,

Basically you can't. The user still has the security token it got when he logged in. It only changes the next time he logs in.


Hope you are wrong???
Top
#176395 - 2007-05-22 09:27 PM Re: OT update groupmembership of logged on user [Re: pvds]
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
I'm pretty sure I'm not wrong, however you can force the user remotely to logg off using WMI.
Top
#176396 - 2007-05-22 09:47 PM Re: OT update groupmembership of logged on user [Re: Arend_]
pvds Offline
Hey THIS is FUN
*****

Registered: 2001-04-14
Posts: 201
 Originally Posted By: apronk
I'm pretty sure I'm not wrong, however you can force the user remotely to logg off using WMI.


That is not an option

Thanks any way
Top
#176401 - 2007-05-22 10:45 PM Re: OT update groupmembership of logged on user [Re: pvds]
masken Offline
MM club member
*****

Registered: 2000-11-27
Posts: 1222
Loc: Gothenburg, Sweden
The question I'd like to ask is why do you need to change a group membership in an active session? There ought to be other ways to deal with the root of the problem perhaps...
_________________________
The tart is out there

Top
#176403 - 2007-05-22 11:15 PM Re: OT update groupmembership of logged on user [Re: pvds]
Mart Moderator Offline
KiX Supporter
*****

Registered: 2002-03-27
Posts: 4673
Loc: The Netherlands
There is no other way. A user's groups are checked at logon and there for the security setting are issued to the user through group membership.
A logoff and logon might get you some annoyed users but afaik it's the only way. Whether or not it's a forced logoff depends on the changes you made and how sensitive the data is that the user should no longer access.
_________________________
Mart

- Chuck Norris once sold ebay to ebay on ebay.

Top
#176406 - 2007-05-23 12:08 AM Re: OT update groupmembership of logged on user [Re: Mart]
StarwarsKid Offline
Seasoned Scripter
*****

Registered: 2005-06-15
Posts: 506
Loc: Oregon, USA
I have to confirm what Mart says. logoff/on is the only method of updating the users security token in a windows domain.
_________________________
let the wise listen and add to their learning,
and let the discerning get guidance- Proverbs 1:5

Top
#176409 - 2007-05-23 02:52 AM Re: OT update groupmembership of logged on user [Re: StarwarsKid]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Disable the account and access will stop right away when he/she clicks on any new object he/she has not already accessed.

Otherwise as stated, a log off is required to obtain a new/modified security token.
Top
#176410 - 2007-05-23 07:00 AM Re: OT update groupmembership of logged on user [Re: masken]
pvds Offline
Hey THIS is FUN
*****

Registered: 2001-04-14
Posts: 201
 Originally Posted By: masken
The question I'd like to ask is why do you need to change a group membership in an active session? There ought to be other ways to deal with the root of the problem perhaps...


we limit the amount of data received from internet. Using a ISA 2006 server by removing a user (students) from the internet allow group he or she have no internet connection anymore.

This is working the same as acces to a share or folder I tested this.

Peter
Top
#176413 - 2007-05-23 11:37 AM Re: OT update groupmembership of logged on user [Re: pvds]
Lee Wilmott Offline
Starting to like KiXtart

Registered: 2002-09-17
Posts: 106
Loc: Bristol, UK
ummm...Interesting topic!

There do exist 3rd party add-ons to MS ISA that do exactly as you wish!

The other "possible" (but crazy) option (and I haven't tested this) is...

The problem with adding everyone to a group and then giving that group permissions to access the ISA server has already been highlighted - the users security token needs updating; and this is only performed at logon.

Instead of adding everyone to a group and then giving that group permissions to access the ISA server, try...

Listing all your users in ISA on a user-by-user basis. If users exceed their internet quota, then you can automate the removal of their user account from the ISA server.

I don't believe they will need to logout and back in again, because their security token doesn't need updating. When they next access the ISA server their security token will not be in the ISA access list and they 'should' be denied access.

Please Note...While "theorectically" I think this will work...Personally I wouldn't recommend it. I have no idea how many users you have and adding all the users one by one would be crazy. Enumerating this access list is likely to be slow. Also, when you create a user you'd have to ensure that you add them to the ISA server access list.

...there are loads of other reasons why I wouldn't do as I suggest. However, I 'think' this will work.

My own opinion is to invest in a 3rd party add-on to ISA Server.

Good luck!

Lee
Top
#176414 - 2007-05-23 11:42 AM Re: OT update groupmembership of logged on user [Re: pvds]
Mart Moderator Offline
KiX Supporter
*****

Registered: 2002-03-27
Posts: 4673
Loc: The Netherlands
I'm getting confused.
Are you doing this to groups that access the internet with an ISA server or is this about groups having access to data on a share?
_________________________
Mart

- Chuck Norris once sold ebay to ebay on ebay.

Top
#176415 - 2007-05-23 01:01 PM Re: OT update groupmembership of logged on user [Re: Mart]
Lee Wilmott Offline
Starting to like KiXtart

Registered: 2002-09-17
Posts: 106
Loc: Bristol, UK
Mart,

I assume from this quote...
 Originally Posted By: pvds
we limit the amount of data received from internet. Using a ISA 2006 server by removing a user (students) from the internet allow group he or she have no internet connection anymore.

This is working the same as acces to a share or folder I tested this.

Peter
...that Peter is trying to limit this on his ISA Server; but has also tested it on a share and a folder.

Anyway, I 'think' that the theory that I mentioned will work, no matter what the resource...share/folder, ISA server. Having said that, although I think it'll work - I wouldn't do it. In fact, my advice would be to drop such an idea!

Lee

Edited by Lee Wilmott (2007-05-23 01:04 PM)
Top
#176417 - 2007-05-23 03:01 PM Re: OT update groupmembership of logged on user [Re: pvds]
Les Offline
KiX Master
*****

Registered: 2001-06-11
Posts: 12734
Loc: fortfrances.on.ca
 Originally Posted By: pvds
This is working the same as acces to a share or folder I tested this.

Peter
I think not.
The user token is not used by ISA like when a user accesses a share.
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.

Top
#176418 - 2007-05-23 03:05 PM Re: OT update groupmembership of logged on user [Re: Lee Wilmott]
pvds Offline
Hey THIS is FUN
*****

Registered: 2001-04-14
Posts: 201
Lee,

 Originally Posted By: Lee Wilmott
ummm...Interesting topic!

There do exist 3rd party add-ons to MS ISA that do exactly as you wish!

The other "possible" (but crazy) option (and I haven't tested this) is...

The problem with adding everyone to a group and then giving that group permissions to access the ISA server has already been highlighted - the users security token needs updating; and this is only performed at logon.

Instead of adding everyone to a group and then giving that group permissions to access the ISA server, try...

Listing all your users in ISA on a user-by-user basis. If users exceed their internet quota, then you can automate the removal of their user account from the ISA server.

I don't believe they will need to logout and back in again, because their security token doesn't need updating. When they next access the ISA server their security token will not be in the ISA access list and they 'should' be denied access.

Please Note...While "theorectically" I think this will work...Personally I wouldn't recommend it. I have no idea how many users you have and adding all the users one by one would be crazy. Enumerating this access list is likely to be slow. Also, when you create a user you'd have to ensure that you add them to the ISA server access list.

...there are loads of other reasons why I wouldn't do as I suggest. However, I 'think' this will work.

My own opinion is to invest in a 3rd party add-on to ISA Server.

Good luck!

Lee


This works,

Is there a way to script this putting a user in a denyRule ;-)

Yes I tested it on a share to be shure.

Kind Regards

Peter
Top
#176419 - 2007-05-23 03:27 PM Re: OT update groupmembership of logged on user [Re: pvds]
Lee Wilmott Offline
Starting to like KiXtart

Registered: 2002-09-17
Posts: 106
Loc: Bristol, UK
 Originally Posted By: pvds
Is there a way to script this putting a user in a denyRule ;-)


Peter,

denyRule? You shouldn't need to deny any permissions!

I don't really know how you would change the permissions on ISA Server. Although I'm a firm believer that anything is possible; I just don't know how to do it (YET)!

In terms of NTFS permissions...that is very simple. There are many examples on this board...also, try looking at the cacls.exe tool.

In any case, can I reiterate...are you sure you want to do this?

Investing in a 3rd party tool would be 'much' better.

Lee
Top
#176421 - 2007-05-23 03:53 PM Re: OT update groupmembership of logged on user [Re: Lee Wilmott]
pvds Offline
Hey THIS is FUN
*****

Registered: 2001-04-14
Posts: 201
Lee,

I have a 3rd party tool called PapercutNG and the restrict internet usage to pull a user from a group.
This is not working without a log off and log on so I am looking for a other way to do this and when I am able to put a user in or out of a “User Set” it make no difference if it is a allow or deny rule.
I think it is possible with powershell Monad I have no experience with this.

Peter
Top
#176440 - 2007-05-24 02:56 PM Re: OT update groupmembership of logged on user [Re: pvds]
pvds Offline
Hey THIS is FUN
*****

Registered: 2001-04-14
Posts: 201
Hi all,

I have a nice working work around I put the domainusers in a isa server local group and this works great.

Thanks for all

Peter
Top
#176449 - 2007-05-24 06:18 PM Re: OT update groupmembership of logged on user [Re: pvds]
Les Offline
KiX Master
*****

Registered: 2001-06-11
Posts: 12734
Loc: fortfrances.on.ca
Ah, the UGLY principle is not so UGLY after all.
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.

Top
Page 1 of 1 1


Moderator:  Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 2220 anonymous users online.
details
Newest Members
Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users
My Cookies · Mark all read Powered by UBB.threads™ Contact Us · KiXtart.org website · Top

Generated in 0.129 seconds in which 0.081 seconds were spent on a total of 13 queries. Zlib compression enabled.
Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org