What's the difference between the Automatically log off users when logon time expires and Automatically log off users when logon time expires (Local) Group Policy Object (GPO) settings under \\computer configuration\\windows settings\\security settings\\local policies\\security options? And why don't these policies seem to work consistently? I enabled Automatically log off users when logon time expires in my Default Domain Policy GPO, and the policy appears to be in effect on the local machines, but users remain logged on after their logon times expire. What can I do to get these settings to work properly?

Automatically log off users when logon time expires affects all computers in the domain, but Windows 2000 only looks at this policy in GPOs that are linked to the domain root. The policy has no effect in GPOs that are linked to organizational units (OUs). Automatically log off users when logon time expires (Local) behaves like most GPO policies. When you use a GPO to enable this policy, any computers to which that GPO applies will disconnect users who remain logged on remotely after their logon hours expire. For example, if you enable Automatically log off users when logon time expires (Local) on your File Servers OU, the policy will disconnect all computers in that OU after logon hours expire, but other computers in the domain will remain connected. If you enable or disable Automatically log off users when logon time expires at the domain level, that setting will override any GPOs in which you enabled or disabled Automatically log off users when logon time expires (Local).

Also be aware that these policies disconnect users who are connected over the network from other computers when their logon hours expire—but only if those connections are inactive. For example, Jim's logon hours are between 7:00 a.m. and 9:00 p.m. Jim logs on at 8:00 a.m. from his workstation, maps a drive to server A and another drive to server B, and remains logged on after 9:00 p.m. Jim frequently accesses files on server A but doesn't access server B at all. At 9:00 p.m., server B will disconnect Jim, but server A won't.