User controls for a computer

• US 20040003279A1
• Filed: 06/28/2002
• Published: 01/01/2004
• Est. Priority Date: 06/28/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Flo, Eric R., Reasor, Sterling M., Chen, Raymond J., Ramasubramanian, Ramkumar, Evans, Christopher A., Beilinson, Craig Adam, Davis, Dennis L.
• Granted Patent: US 7,356,836 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

This invention is directed to provide a method for enabling an administrator to monitor and selectively limit the computer functions available to a user. The method is carried out on a personal computer by an administrator, and administrator decisions can be enforced on other personal computers in a local network. The invention enables an administrator to restrict a user'"'"'s logon hours, logon duration, access to computer functions, and access to applications based on content rating. In addition, the administrator may temporarily restrict or extend normally allowed access privileges. The invention also allows for the monitoring, auditing, and reporting of a user'"'"'s computer function usage to an administrator.

Claims

1. A method for selectively limiting a user'"'"'s use of a computer, comprising:

receiving on the computer user authorization settings for at least one user;

receiving from the user a request to perform an action on the computer; and

determining based on the user authorization settings whether the user is authorized to perform the action on the computer, and, if so, performing the action.

2. The method of claim 1, wherein the step of receiving on the computer user authorization settings includes receiving user authorization settings stored in at least one group policy object.

3. The method of claim 1, wherein the request to perform an action is a request to log on to the computer.

4. The method of claim 1, wherein the request to perform an action is a request to perform a computer function.

5. The method of claim 1, wherein the request to perform an action is a request to execute an application.

6. The method of claim 1, wherein the user authorization settings include settings to authorize a user to log on to the computer.

7. The method of claim 6, wherein the settings to authorize a user to log on to the computer include settings to deny a logon request by the user.

8. The method of claim 1, wherein the user authorization settings include the hours during which the user is authorized to use the computer.

9. The method of claim 8, further comprising terminating the user'"'"'s use of the computer outside of the hours during which the user is authorized to use the computer.

10. The method of claim 9, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer.

11. The method of claim 1, wherein the user authorization settings include a maximum amount of time per specified time interval that the user is authorized to use the computer.

12. The method of claim 11, further comprising terminating the user'"'"'s use of the computer during the specified time interval if the maximum amount of time per specified time interval is exceeded.

13. The method of claim 11, wherein the specified time interval is a day.

14. The method of claim 12, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer.

15. The method of claim 1, wherein the user authorization settings include settings to deny a user access to a computer function.

16. The method of claim 15, wherein the settings to grant a user access to a computer function are contained in a computer functions list.

17. The method of claim 16, wherein the computer functions list includes applications installed on the computer.

18. The method of claim 16, wherein the computer functions list includes for at least one computer function the hours during which the user may direct the computer to perform the function.

19. The method of claim 18, further comprising terminating the user'"'"'s use of the computer function outside of the hours during which the user is authorized to use the computer function.

20. The method of claim 19, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer function.

21. The method of claim 16, wherein the computer functions list includes for at least one computer function the amount of time per specified time interval that a user may direct the computer to perform the at least one computer function.

22. The method of claim 21, further comprising terminating the user'"'"'s use of the computer function when the user'"'"'s use of the computer function exceeds the amount of time per specified time interval that a user may direct the computer to perform the at least one computer function.

23. The method of claim 22, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer function.

24. The method of claim 21, wherein the specified time interval is a day.

25. The method of claim 16, wherein the computer functions list includes for at least one computer function an associated content rating for determining whether the user may access the at least one computer function.

26. The method of claim 1, wherein the user authorization settings include the types of data collected concerning the user'"'"'s use of the computer.

27. The method of claim 1, further comprising storing data concerning the user'"'"'s use of the computer in a user activity log.

28. The method of claim 27, further comprising storing data concerning the user'"'"'s use of the computer in accordance with the user authorization settings.

29. The method of claim 1, further comprising transmitting a request to temporarily modify the user authorization settings.

30. The method of claim 29, further comprising receiving updated user authorization settings after transmitting a request to temporarily modify the user authorization settings.

31. The method of claim 30, wherein the updated user authorization settings are contained in a group policy object.

46. The method of claim 23, wherein the user authorization settings include settings to deny a user access to a computer function.

47. The method of claim 46, wherein the settings to grant a user access to a computer function are contained in a computer functions list.

48. The method of claim 47, wherein the computer functions list includes applications installed on the computer.

49. The method of claim 47, wherein the computer functions list includes for at least one computer function the hours during which the user may direct the computer to perform the function.

50. The method of claim 49, further comprising terminating the user'"'"'s use of the computer function outside of the hours during which the user is authorized to use the computer function.

51. The method of claim 50, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer function.

52. The method of claim 47, wherein the computer functions list includes for at least one computer function the amount of time per specified time interval that a user may direct the computer to perform the at least one computer function.

53. The method of claim 52, further comprising terminating the user'"'"'s use of the computer function when the user'"'"'s use of the computer function exceeds the amount of time per specified time interval that a user may direct the computer to perform the at least one computer function.

54. The method of claim 53, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer function.

55. The method of claim 52, wherein the specified time interval is a day.

56. The method of claim 47, wherein the computer functions list includes for at least one computer function an associated content rating for determining whether the user may access the at least one computer function.

32. A method for selectively limiting a user'"'"'s use of a computer in a local network wherein at least one computer in the local network has a group policy object for the user, comprising:

receiving on the computer at least one group policy object containing user authorization settings for at least one user;

receiving from the user a request to perform an action on the computer; and

determining based on the user authorization settings whether the user is authorized to perform the action on the computer, and, if so, performing the action.

33. The method of claim 32, wherein the step of receiving on the computer user authorization settings includes receiving user authorization settings stored in at least one group policy object.

34. The method of claim 32, wherein the request to perform an action is a request to log on to the computer.

35. The method of claim 32, wherein the request to perform an action is a request to perform a computer function.

36. The method of claim 32, wherein the request to perform an action is a request to execute an application.

37. The method of claim 32, wherein the user authorization settings include settings to authorize a user to log on to the computer.

38. The method of claim 37, wherein the settings to authorize a user to log on to the computer include settings to deny a logon request by the user.

39. The method of claim 32, wherein the user authorization settings include the hours during which the user is authorized to use the computer.

40. The method of claim 39, further comprising terminating the user'"'"'s use of the computer outside of the hours during which the user is authorized to use the computer.

41. The method of claim 40, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer.

42. The method of claim 32, wherein the user authorization settings include a maximum amount of time per specified time interval that the user is authorized to use the computer.

43. The method of claim 42, further comprising terminating the user'"'"'s use of the computer during the specified time interval if the maximum amount of time per specified time interval is exceeded.

44. The method of claim 42, wherein the specified time interval is a day.

45. The method of claim 43, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer.

57. The method of claim 32, wherein the user authorization settings include the types of data collected concerning the user'"'"'s use of the computer.

58. The method of claim 32, further comprising storing data concerning the user'"'"'s use of the computer in a user activity log.

59. The method of claim 58, further comprising storing data concerning the user'"'"'s use of the computer in accordance with the user authorization settings.

60. The method of claim 32, further comprising transmitting a request to temporarily modify the user authorization settings.

61. The method of claim 60, further comprising receiving updated user authorization settings after transmitting a request to temporarily modify the user authorization settings.

62. The method of claim 61, wherein the updated user authorization settings are contained in a group policy object.

126. The computer-readable medium of claim 41, further comprising terminating the user'"'"'s use of the computer during the specified time interval if the maximum amount of time per specified time interval is exceeded.

128. The computer-readable medium of claim 126, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer.

63. A method for monitoring and selectively limiting a user'"'"'s use of a computer in a local network, wherein each computer in the local network is adapted to receive a group policy object and based thereon to selectively limit the user'"'"'s use of the computer comprising:

receiving user authorization settings for at least one user;

storing the user authorization settings in a group policy object; and

transmitting the group policy object to at least one computer in the local network.

64. The method of claim 63, further comprising configuring the user authorization settings to limit the user'"'"'s user of the computer.

65. The method of claim 64, wherein the user authorization settings are configured to authorize a user to log on to the computer.

66. The method of claim 64, wherein the user authorization settings include the hours during which the user is authorized to use the computer.

67. The method of claim 64, wherein the user authorization settings include a maximum amount of time per specified time interval that the user is authorized to use the computer.

68. The method of claim 67, wherein the specified time interval is a day.

69. The method of claim 63, further comprising configuring the user authorization settings to limit user activity collected in a user activity log.

70. The method of claim 69, further comprising storing user activity data in the user activity log in accordance with the user authorization settings.

71. The method of claim 69, wherein the displaying the user activity data is limited in accordance with the user authorization settings.

72. The method of claim 69, further comprising receiving a request to temporarily modify the user authorization settings.

73. The method of claim 72, further comprising,

modifying the existing user authorization settings to produce updated user authorization settings;

and

transmitting a group policy object containing updated user authorization settings.

74. The method of claim 73, wherein the updated user authorization settings expire after a specified time interval and the user authorization settings revert to the existing user authorization settings.

75. The method of claim 63, wherein the user authorization settings include settings to deny a user access to a computer function.

76. The method of claim 75, wherein the settings to deny a user access to a computer function are contained in a computer functions list.

77. The method of claim 76, wherein the computer functions list includes applications installed on the computer.

78. The method of claim 76, wherein the computer functions list includes for at least one computer function the hours of day during which the user may direct the computer to perform the function.

79. The method of claim 78, further comprising terminating the user'"'"'s use of the computer function outside of the hours during which the user is authorized to use the computer.

80. The method of claim 76, wherein the computer functions list includes for at least one computer function the amount of time per specified time interval that a user may direct the computer to perform the at least one computer function.

81. The method of claim 80, wherein the specified time interval is a day.

82. The method of claim 76, wherein the computer functions list includes for at least one computer function an associated content rating for determining whether the user may access the at least one computer function.

83. The method of claim 63, further comprising displaying on another computer in the local network the content of the user'"'"'s computer video display.

84. A computer-readable medium containing computer executable instructions for performing a method for selectively limiting a user'"'"'s use of a computer, the method comprising:

receiving on the computer user authorization settings for at least one user;

receiving from the user a request to perform an action on the computer; and

determining based on the user authorization settings whether the user is authorized to perform the action on the computer, and, if so, performing the action.

85. The computer-readable medium of claim 84, wherein the step of receiving on the computer user authorization settings includes receiving user authorization settings stored in at least one group policy object.

86. The computer-readable medium of claim 84, wherein the request to perform an action is a request to log on to the computer.

87. The computer-readable medium of claim 84, wherein the request to perform an action is a request to perform a computer function.

88. The computer-readable medium of claim 84, wherein the request to perform an action is a request to execute an application.

89. The computer-readable medium of claim 84, wherein the user authorization settings include settings to authorize a user to log on to the computer.

90. The computer-readable medium of claim 89, wherein the settings to authorize a user to log on to the computer include settings to deny a logon request by the user.

91. The computer-readable medium of claim 84, wherein the user authorization settings include the hours during which the user is authorized to use the computer.

92. The computer-readable medium of claim 91, further comprising terminating the user'"'"'s use of the computer outside of the hours during which the user is authorized to use the computer.

93. The computer-readable medium of claim 92, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer.

94. The computer-readable medium of claim 84, wherein the user authorization settings include a maximum amount of time per specified time interval that the user is authorized to use the computer.

95. The computer-readable medium of claim 94, further comprising terminating the user'"'"'s use of the computer during the specified time interval if the maximum amount of time per specified time interval is exceeded.

96. The computer-readable medium of claim 94, wherein the specified time interval is a day.

97. The computer-readable medium of claim 95, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer.

98. The computer-readable medium of claim 84, wherein the user authorization settings include settings to deny a user access to a computer function.

99. The computer-readable medium of claim 98, wherein the settings to grant a user access to a computer function are contained in a computer functions list.

100. The computer-readable medium of claim 99, wherein the computer functions list includes applications installed on the computer.

101. The computer-readable medium of claim 99, wherein the computer functions list includes for at least one computer function the hours during which the user may direct the computer to perform the function.

102. The computer-readable medium of claim 101, further comprising terminating the user'"'"'s use of the computer function outside of the hours during which the user is authorized to use the computer function.

103. The computer-readable medium of claim 102, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer function.

104. The computer-readable medium of claim 101, wherein the computer functions list includes for at least one computer function the amount of time per specified time interval that a user may direct the computer to perform the at least one computer function.

105. The computer-readable medium of claim 104, further comprising terminating the user'"'"'s use of the computer function when the user'"'"'s use of the computer function exceeds the amount of time per specified time interval that a user may direct the computer to perform the at least one computer function.

106. The computer-readable medium of claim 105, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer function.

107. The computer-readable medium of claim 104, wherein the specified time interval is a day.

108. The computer-readable medium of claim 99, wherein the computer functions list includes for at least one computer function an associated content rating for determining whether the user may access the at least one computer function.

109. The computer-readable medium of claim 84, wherein the user authorization settings include the types of data collected concerning the user'"'"'s use of the computer.

110. The computer-readable medium of claim 84, further comprising storing data concerning the user'"'"'s use of the computer in a user activity log.

111. The computer-readable medium of claim 110, further comprising storing data concerning the user'"'"'s use of the computer in accordance with the user authorization settings.

112. The computer-readable medium of claim 84, further comprising transmitting a request to temporarily modify the user authorization settings.

113. The computer-readable medium of claim 112, further comprising receiving updated user authorization settings after transmitting a request to temporarily modify the user authorization settings.

114. The computer-readable medium of claim 113, wherein the updated user authorization settings are contained in a group policy object.

115. A computer-readable medium containing computer executable instructions for performing a method for selectively limiting a user'"'"'s use of a computer in a local network wherein at least one computer in the local network has a group policy object for the user, the method comprising:

receiving on the computer at least one group policy object containing user authorization settings for at least one user;

receiving from the user a request to perform an action on the computer; and

determining based on the user authorization settings whether the user is authorized to perform the action on the computer, and, if so, performing the action.

116. The computer-readable medium of claim 115, wherein the step of receiving on the computer user authorization settings includes receiving user authorization settings stored in at least one group policy object.

117. The computer-readable medium of claim 115, wherein the request to perform an action is a request to log on to the computer.

118. The computer-readable medium of claim 115, wherein the request to perform an action is a request to perform a computer function.

119. The computer-readable medium of claim 115, wherein the request to perform an action is a request to execute an application.

120. The computer-readable medium of claim 115, wherein the user authorization settings include settings to authorize a user to log on to the computer.

121. The computer-readable medium of claim 120, wherein the settings to authorize a user to log on to the computer include settings to deny a logon request by the user.

122. The computer-readable medium of claim 115, wherein the user authorization settings include the hours during which the user is authorized to use the computer.

123. The computer-readable medium of claim 122, further comprising terminating the user'"'"'s use of the computer outside of the hours during which the user is authorized to use the computer.

124. The computer-readable medium of claim 123, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer.

125. The computer-readable medium of claim 115, wherein the user authorization settings include a maximum amount of time per specified time interval that the user is authorized to use the computer.

127. The computer-readable medium of claim 125, wherein the specified time interval is a day.

129. The computer-readable medium of claim 115, wherein the user authorization settings include settings to deny a user access to a computer function.

130. The computer-readable medium of claim 129, wherein the settings to grant a user access to a computer function are contained in a computer functions list.

131. The computer-readable medium of claim 130, wherein the computer functions list includes applications installed on the computer.

132. The computer-readable medium of claim 130, wherein the computer functions list includes for at least one computer function the hours during which the user may direct the computer to perform the function.

133. The computer-readable medium of claim 132, further comprising terminating the user'"'"'s use of the computer function outside of the hours during which the user is authorized to use the computer function.

134. The computer-readable medium of claim 133, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer function.

135. The computer-readable medium of claim 130, wherein the computer functions list includes for at least one computer function the amount of time per specified time interval that a user may direct the computer to perform the at least one computer function.

136. The computer-readable medium of claim 135, further comprising terminating the user'"'"'s use of the computer function when the user'"'"'s use of the computer function exceeds the amount of time per specified time interval that a user may direct the computer to perform the at least one computer function.

137. The computer-readable medium of claim 136, further comprising saving the state of the computer when terminating the user'"'"'s use of the computer function.

138. The computer-readable medium of claim 135, wherein the specified time interval is a day.

139. The computer-readable medium of claim 130, wherein the computer functions list includes for at least one computer function an associated content rating for determining whether the user may access the at least one computer function.

140. The computer-readable medium of claim 115, wherein the user authorization settings include the types of data collected concerning the user'"'"'s use of the computer.

141. The computer-readable medium of claim 115, further comprising storing data concerning the user'"'"'s use of the computer in a user activity log.

142. The computer-readable medium of claim 141, further comprising storing data concerning the user'"'"'s use of the computer in accordance with the user authorization settings.

143. The computer-readable medium of claim 115, further comprising transmitting a request to temporarily modify the user authorization settings.

144. The computer-readable medium of claim 143, further comprising receiving updated user authorization settings after transmitting a request to temporarily modify the user authorization settings.

145. The computer-readable medium of claim 144, wherein the updated user authorization settings are contained in a group policy object.

146. A computer-readable medium containing computer executable instructions for performing a method for monitoring and selectively limiting a user'"'"'s use of a computer in a local network, wherein each computer in the local network is adapted to receive a group policy object and based thereon to selectively limit the user'"'"'s use of the computer, the method comprising:

receiving user authorization settings for at least one user;

storing the user authorization settings in a group policy object; and

transmitting the group policy object to at least one computer in the local network.

147. The computer-readable medium of claim 146, further comprising configuring the user authorization settings to limit the user'"'"'s user of the computer.

148. The computer-readable medium of claim 147, wherein the user authorization settings are configured to authorize a user to log on to the computer.

149. The computer-readable medium of claim 146, wherein the user authorization settings include the hours during which the user is authorized to use the computer.

150. The computer-readable medium of claim 146, wherein the user authorization settings include a maximum amount of time per specified time interval that the user is authorized to use the computer.

151. The computer-readable medium of claim 150, wherein the specified time interval is a day.

152. The computer-readable medium of claim 146, further comprising configuring the user authorization settings to limit user activity collected in a user activity log.

153. The computer-readable medium of claim 152, further comprising storing user activity data in the user activity log in accordance with the user authorization settings.

154. The computer-readable medium of claim 152, wherein the displaying the user activity data is limited in accordance with the user authorization settings.

155. The computer-readable medium of claim 146, further comprising receiving a request to temporarily modify the user authorization settings.

156. The computer-readable medium of claim 155, further comprising,

modifying the existing user authorization settings to produce updated user authorization settings;

and

transmitting a group policy object containing updated user authorization settings.

157. The computer-readable medium of claim 156, wherein the updated user authorization settings expire after a specified time interval and the user authorization settings revert to the existing user authorization settings.

158. The computer-readable medium of claim 146, wherein the user authorization settings include settings to deny a user access to a computer function.

159. The computer-readable medium of claim 158, wherein the settings to deny a user access to a computer function are contained in a computer functions list.

160. The computer-readable medium of claim 159, wherein the computer functions list includes applications installed on the computer.

161. The computer-readable medium of claim 159, wherein the computer functions list includes for at least one computer function the hours of day during which the user may direct the computer to perform the function.

162. The computer-readable medium of claim 161, further comprising terminating the user'"'"'s use of the computer function outside of the hours during which the user is authorized to use the computer.

163. The computer-readable medium of claim 159, wherein the computer functions list includes for at least one computer function the amount of time per specified time interval that a user may direct the computer to perform the at least one computer function.

164. The computer-readable medium of claim 163, wherein the specified time interval is a day.

165. The computer-readable medium of claim 159, wherein the computer functions list includes for at least one computer function an associated content rating for determining whether the user may access the at least one computer function.

166. The computer-readable medium of claim 146, further comprising displaying on another computer in the local network the content of the user'"'"'s computer video display.