Management asked me to restrict two employees' computer logons because they reportedly clock in around 6 a.m., leave for Starbucks for an hour or two, and then return. HR wants to follow its formal discipline process, especially given California employment considerations. My proposed solution is to allow logons only 30 minutes before and after each employee's scheduled shift. Has anyone implemented logon-hour restrictions for a situation like this? Does it actually help, or would auditing time-clock records, door access, application activity, or workstation usage be more appropriate? I also want to avoid creating problems with file shares, SSO, locked sessions, or other systems.
4 Answers
This is primarily a management and HR problem, not an IT problem. Restricting Windows logons does not stop someone from clocking in and walking away, and it may give them a legitimate technical issue to report instead. Their manager should verify the absence, document it, and handle the disciplinary process. If the goal is preventing early clock-ins or unauthorized overtime, that restriction belongs in the timekeeping system.
If employees are clocking in too early, ask the timekeeping-system owner whether early punches can be blocked or automatically adjusted to the scheduled start time. That directly addresses the suspected overtime issue without turning a personnel matter into an access-control project. If management still wants logon restrictions, get the request and business justification in writing, make sure the policy applies consistently, and let HR communicate it to affected staff.
If HR needs evidence, use the systems that actually measure the behavior: time-clock records, badge entry and exit logs, camera footage where permitted, and manager observation. You can also review endpoint or application activity, but treat that as supporting evidence rather than proof that someone was actively working. A logged-in computer does not establish that the employee was present or productive.
A screen-lock and unlock history can show long periods away from a workstation, but it still needs to be interpreted carefully. People can be working elsewhere, in meetings, or using a different device.
Be cautious with domain logon-hour restrictions. Login, unlock, logout, sleep, and hibernation are different events, so the policy may not behave the way management expects. A restriction can also interfere with file shares, mapped drives, SSO applications, or users who are still logged in outside the permitted window. Test it on a nonproduction account and involve HR before applying it broadly.
Exactly. We once had managers ask IT to stop employees from accessing laptops because they were claiming questionable overtime. The real fix was for supervisors to review and approve the time, not to push the responsibility onto IT.