Active Directory Question

IristheangelIristheangel Mod Posts: 4,133 Mod
This isn't really a certification question but I was hoping you guys could help me out here. My enterprise runs Server 2003 and we give VPN access to users by adding them a VPN global group membership to their AD account. Yesterday we had a meeting with our networking team about VPN compliance and they were claiming that we could add expiration dates for specific users for that specific AD membership so they wouldn't have VPN access forever. For example, we use the membership "VPN-Contractors" to grant all contractors VPN access. Basically the networking guys in our organization are saying we can add all the contractors to this one global group and somehow set up a bunch of different "expiration dates" (not expiration dates on the account, but an different expiration date per user on the global group ) that will automatically remove each person from the group at different time.
I've never heard of this being done on 2003 before (not sure if it's a 2008 thing) and googling turned up nothing. I'm assuming the networking guys don't really know anything about AD but just verifying with the rest of you
BS, MS, and CCIE #50931
Blog: www.network-node.com


  • Options
    crrussell3crrussell3 Member Posts: 561
    The only way I can think of to automatically remove a user from a group on a specific date is to write a script that will perform that function for you and set it as a scheduled task.
    MCTS: Windows Vista, Configuration
    MCTS: Windows WS08 Active Directory, Configuration
Sign In or Register to comment.