How to ban a user from submitting jobs

Known to work with HTCondor version: 7.0

Suppose a user is submitting jobs that are causing problems (like crashing machines) and you need to temporarily block the user until you can talk with them and solve the problem.

How to ban a user from submitting jobs

Add the following to the submit machine configuration: 

DENY_WRITE = dan@hep.wisc.edu/*

Then run 

condor_reconfig -full <submit machine name>
. You might need to run that from the central manager if only the central manager is allowed to run administrative commands in your HTCondor pool. To verify that this configuration setting was successfully processed, query the schedd: 

condor_config_val -schedd DENY_WRITE

How to ban a user from joining the pool

If you do not control the submit machine, you could block the user from advertising to the pool collector. Use 

condor_status -submitters
to see the value of the submitter ad's Name attribute for the user to be banned. (You can use the -long option if the name is truncated in the output.) Then enter it into the following configuration settings and run 
condor_reconfig
. It will take ~15 minutes for the existing submitter ad to expire, so restart the collector if you are in a hurry. 

IsBannedSubmitter = MyType == "Submitter" && Name == "dan@hep.wisc.edu"
COLLECTOR_REQUIREMENTS = ($(IsBannedSubmitter)) == False

How to ban a user from executing jobs on specific machines

If you just want to ban a user from submitting to some but not all machines, you could do that in the execute machine configuration: 

IsBannedUser = User =?= "dan@hep.wisc.edu"
START =  ($(START)) && ( ($(IsBannedUser))  == FALSE )

Run 

condor_reconfig -all
after you have made that change (or just reconfig the execute machines that need it).