Two employees have been clocking in around 6 a.m., logging into their computers, leaving the building to visit a nearby coffee shop, and returning an hour or two later. Management and HR are handling the disciplinary process, but leadership has asked IT for a technical way to discourage the behavior. The proposed solution is to restrict their computer logons to a window beginning 30 minutes before their scheduled shift and ending 30 minutes after it. Has anyone used logon-hour restrictions for this purpose, and are there technical or policy issues to consider?
5 Answers
If evidence is needed, use existing audit sources: building badge records, security footage where appropriate, time-clock data, application and firewall logs, or endpoint activity reports. A computer being locked or inactive for long periods can support the investigation, but it should be coordinated with HR and handled according to company policy and local law.
This is primarily a management and HR problem, not an IT problem. Restricting logons does not stop someone from clocking in and walking away; it may just create a new excuse when they cannot access their computer. Their manager should document when they leave, compare that with time-clock records, and handle the conduct directly.
Exactly. If they can log in during the approved window and then disappear, the restriction has not solved anything. Management needs to verify attendance and enforce the work schedule.
Start with the time-clock system. Many systems can prevent employees from clocking in too early or automatically adjust an early punch to the scheduled start time. That addresses the potential overtime issue more directly than changing Windows authentication.
The fact that the employees are in California does not automatically prevent termination; it is still an at-will employment state. However, HR should manage the legal and documentation risks. IT should implement an approved policy, not invent technical controls to compensate for a manager who is not monitoring attendance.
Be careful with logon-hour restrictions. Windows logon, unlock, logout, hibernation, file-share access, and single sign-on sessions are not all the same thing. A restriction can cause confusing failures for users who are already logged in or connected to other services. If leadership insists on using it, have HR communicate the policy, apply it consistently, and test the effect before making it part of a disciplinary action.
A short screen-lock interval combined with reviewing unlock and logon events can show long periods away from the workstation, although that still does not prove where the employee was or replace direct management observation.