5

They usually connect to our network by a VPN. Right now there is just the (password protected) Administrator account and their domain user account on the laptop. Windows 7 and Server 2008R2 in use here.

I want to change their password or disable/lock their account and have it take immediate effect so that they cannot get to our domain at all, or get to any files on the laptop.

If they're logged in already, do they have to log out first? If they're not logged into the VPN, won't the computer just save their previous password/credentials if they log on when not connected to any network?

Is there another way to do what I want to do?

2
  • Just disabling the account won't do it? I'm assuming this is a fired employee...why isn't the IT department locking out the account? Jun 11, 2012 at 18:54
  • 1
    @BartSilverstrim I gather that Matt is the IT department. Locking on the domain side and forcing him off the VPN are easier tasks. I think the challenge rests in the remote laptop that he doesn't have physical control over. Cached credentials and files held remotely can be issues. Jun 11, 2012 at 19:17

2 Answers 2

6

If they're not connected via VPN, there's nothing you can do. The machine is offline from your perspective, and cached credentials will still work for them. You can disable their account to prevent a VPN connection, but then you will never get control of the machine.

One option would be to let them connect, or instruct them to connect if you have that option from a legal perspective, then lock them out. But they could still remove the disk and get at data unless you are using something like BitLocker.

But your best option is probably to have HR/legal call them and remind them of their obligations with regards to corporate data and assets, and sick law enforcement on them for theft if they don't comply immediately. Provide them a means to send the laptop back to you without them having to pay for postage or packaging (such as FedEx pickup).

1
  • SWecomd that. This sounds as a technical answer to a non-technical problem.
    – Hennes
    Jun 11, 2012 at 19:28
4

There are a few ways to force logoff mentioned in the SuperUser question about a force user logoff script for Windows 7.

There's also shutdown /l /f and the fantastic SysInternals suite has PsShutdown.

It will be important to remove the cached credentials from the machine. There are many questions about this, but I don't have a definitive answer or a lab to test this in just yet. Look for https://serverfault.com/search?q=cached+credentials

Alternately, and I'd consider this a better solution but it needs pre-planning, you can obliterate the hard drive's crypto key and then force shutdown the machine. Writing over the encrypted key section with gibberish will prevent the user from every booting the machine up to read anything again. Further, if you keep a copy of the key on your end, you can still access whatever was on the drive unless they overwrite it by bootdisking.

1
  • Pertinent avatar is pertinent.
    – Wesley
    Jun 11, 2012 at 19:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .