Logon hours restricitions

Logon hours restrictions provide an ability to restrict user access to published resources during specified time frames using expression-based flexible rules.

Feature details:

• Expression based criteria (User or group, Gateway, Theme, Client).
• Ability to show / hide the list of published resources.
• Force a disconnect or notify users and allow them to extend session time.

Prerequisites

• Time zone redirection is required to be set on the session hosts in order for the feature to work as intended. Enable group policy setting Allow time zone redirection:

1. On the Active Directory server, open the Group Policy Management Console.
2. Expand your domain and Group Policy Objects.
3. Right-click the GPO that you created for the group policy settings and select Edit.
4. In the Group Policy Management Editor, navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection.
5. Enable the setting Allow time zone redirection.

• Parallels Client 19 or newer

Configuration

To add a new logon hours rule:

1. In the RAS Console, navigate to Connection and select the Logon hours tab.
2. Click Tasks > Add (or click the [+] icon).
   
    
3. Specify the following options:
   • Name: Name of the rule.
   • Description: Description of the rule.
   • Criteria: Criteria for applying the rule. The syntax of criteria is described in the article “Expression based filtering & policies”, subsection “Configuration”.
   • Logon hours: Hours when users are permitted to log on. To deny logon during a certain day or period of time, select that day or time and click the Logon denied button that is located to the right of the table.
4. Click OK.
5. Click Apply.
6. You can also specify the following settings for a logon hours rule:
   • Do not allow Parallels Client to connect outside of allowed logon hours: If selected, a Parallels Client is not allowed to connect to resources published on the site.
   • Disconnect user session if the time has elapsed: If selected, shows users a notification that their sessions are going to be disconnected. After selecting this option, you can specify the setting below:
   • Notify user before disconnect: Time when Parallels RAS notifies the user before the client is disconnected from the Farm.
   • Allow user to extend session time: If selected, allows user to extend the session.

To specify these settings:

1. In the RAS Console, navigate to Connection and select the Logon hours tab.

2. Select the rule that you want to configure.

3. Click the gear icon to the left of the Task menu. The Options dialog opens.
   

Note:

• If there is no logon hours rule matching the user/device, the default logic always allowing the connection is applied.

• Creating any logon hours rule restricts the ability to connect to published resources (within a site) using any previous client versions.

• If you disable or do not configure Allow time zone redirection Group Policy setting, the client computer does not redirect its time zone information and thus user session time zone is the same as the server time zone.