Restrict file server (CIFS) access by time of day

There is no built-in functionality to do what you're talking about, per se. What you're looking for is a reasonable enough desire, but not something that Microsoft has implemented as a feature with the granularity you're looking for.

The "Logon Hours" functionality (located on the "Account" tab of the user's account properties in "Active Directory Users and Computers") will give you something like what you want, but it works by denying the right to authenticate to the domain and, as such, it doesn't have the granularity you're looking for.

You could attempt to dynamically change group memberships with scripts, but I suspect you'll accomplish little else than creating a lot of Active Directory replication traffic. I doubt you'll find that, with token caching taken into account, you can reliably deny and restore access at a specific time.

Edit:

I see some other answers talking about changing the file permissions rather than trying to alter group memberships. I also expect that you're going to see disappointing results from that method, too, if there are open files at the time that you change the permissions. (I'd hate to think what kind of hell this might play with Offline Files, too.)


You might consider scheduling Windows tasks to delete and recreate the file shares at the desired times. This may or may not be practical based on the number of shares and number of users or groups whose access you want to control. Whacking a share out from under a connection with open files runs the risk of file corruption if files are changing when the share is removed.


There's no built-in functionality for doing this in Windows, but a scheduled script could change the share or NTFS permissions, thus allowing or denying access to specific users/groups. Have a look at cacls or icacls.