LimitLogin vs. UserLock

Microsoft’s LimitLogin application and UserLock both limit concurrent user logins in an Active Directory domain, but the similarity largely stops there.

This article will focus on how each solution restricts concurrent connections and discuss how else they help an organization secure user access for Windows Active Directory environments.

LimitLogin

LimitLogin is an unsupported tool released in 2005. The application was written by a Microsoft Partner Technology specialist and an Application Development Consultant. At the time, the aim of LimitLogin was to add the ability to track and limit concurrent workstation and terminal user logins in an Active Directory domain.

UserLock

UserLock is a comprehensive access management solution for on-premise and hybrid Active Directory networks. Much more than a tool for limiting concurrent logins, UserLock protects workforce access to corporate networks and cloud applications with multi-factor authentication (MFA), single sign-on (SSO) , contextual access management and session management.

UserLock permits, denies or limits access based on a range of criteria. For example, UserLock prevents concurrent logins via a single identity, limiting access to certain device types and limiting network access methods. UserLock also monitors all sessions in real time providing alerts and information to respond to suspicious events and a log of access information for audit and forensics.

UserLock is developed by IS Decisions, a Microsoft Gold Partner, founded in 2000 and specialized in access security solutions for Microsoft Windows and Active Directory.

Compare LimitLogin vs UserLock

Windows Service*: Except for old Windows XP and 2003 Server for which the micro agent technology is a GINA DLL.
Requirements and Specifications

LimitLogin is not compatible with Windows Server 2008R2, 2012 and 2012R2.

UserLock is certified for compliance and support with Windows Server 2016, 2012, 2012R2, 2008 and 2008R2.

LimitLogin doesn’t support 64-bit systems. UserLock does.

Similar to the status of the resource kit tools and/or the support tools, LimitLogin is not officially supported by Microsoft.

• Windows Server Operating Systems

• Windows Workstation Operating Systems

Limited session types with LimitLogin

LimitLogin capabilities are limited to monitoring only workstation and terminal sessions. UserLock on the other hand allows you to apply access restrictions on all session types (workstations, terminal, interactive, Internet Information Services and Wi-Fi/VPN).

• Audited and Protected User Session Types

Architecture & deployment

A summary comparing the architecture required to monitor and limit the number of workstation and terminal logins:

Deploying LimitLogin

Microsoft LimitLogin was designed to help administrators to apply login limits on their network. It is however complex to implement and unsafe due to the Active Directory schema modification it requires.

Bill Boswell (Microsoft Certified Professional Magazine) wrote this very meticulous and precise breakdown on how to deploy LimitLogin:

“LimitLogin requires a bit of effort to deploy. For one thing, it performs a Schema modification. For another, it creates a new partition in Active Directory. It also requires configuring a Web server with the .NET Framework and ASP.NET and setting it up to do delegated Kerberos authentication. Finally, it requires distributing client packages that support communicating with the Web server via SOAP (a lightweight protocol for exchanging structured information in a distributed environment). Whoa. Don’t stop reading. It’s complicated, but not impossible. Really.”

Deploying UserLock

UserLock installs in minutes on a standard Windows Server. The installation can be done on any server member of the domain. There is no requirement to use a Domain Controller server. Once installed, UserLock must deploy a micro agent onto each workstation that are members of the selected network zone. This can be done through the UserLock console which contains an agent deployer with manual or automatic modes. UserLock reads Active Directory information but doesn’t modify anything regarding accounts nor schema.

The need to manage concurrent user logins

Most organizations with in a Windows environment use Microsoft Active Directory to authenticate and control all users.

However, Active Directory is by no means a fool-proof security solution. Yes, it manages passwords and confirms that the user name matches the password, but it does not stop multiple users from logging on with the same password, at the same time.

This challenge of limiting concurrent logins in a Windows environment averts one of the most potentially dangerous situations for a Windows Active Directory network.

Preventing or limiting concurrent sessions:

•  Stops users sharing their passwords. Users will think twice about sharing credentials, as they won’t be able to get on the system if someone else is logged in too

•  Stops rogue users from using valid credentials at the same time as their legitimate owner

•  Ensures access to critical assets is attributed to individual employees

•  Is required for an information system to comply with major regulatory constraints, including NIST 800-53, SOX, PCI-DSS, HIPAA and the newly updated CJIS requirements.

Why limiting logins isn’t enough to secure network access

The application LimitLogin allows an organization to manage only the number of user logins.

With UserLock, concurrent login control is just one part of a granular MFA and access control solution. UserLock sets and enforces contextual access management, including the ability to restrict user access to the network based on:

• Origin: Define where the user login can take place based on workstation or device, IP range, department, or country.

  • Time: Control when users can logon based on defined working hours and/or maximum session time.

  • Session type: Control the type of user connection by workstation, terminal, WiFi, VPN and IIS sessions to protect both interactive sessions and network access for remote and mobile users.