1

I am trying to write a simple powershell script that ads a domain user to the local admin group on windows machines, and then after 30 Minutes removes them. This is what I have so far.

Param(
  [string]$machineName,
  [string]$group,
  [string]$user
)
$objUser = [ADSI]("WinNT://$user")
$objGroup = [ADSI]("WinNT://$machineName/$group")
$objGroup.PSBase.Invoke("Add",$objUser.PSBase.Path)
sleep 1800
$objGroup.PSBase.Invoke("Remove",$objUser.PSBase.Path)

This script is called with three parameters, and works great. The user is inserted into the group, and 30 Minutes later they are removed.

The last bit I need help on is forcing windows to realize that the user is no longer an admin after 30 minutes...

Currently the user must log off and back in to realize the admin permissions, which I am fine with, but I do not want them to be able to keep the perms past 30 Minutes. How can I force this to happen? Even after being removed from the group, they still can perform admin tasks until they log off.

Thanks in advance.

2 Answers 2

2

I don't believe what you want to do is technically possible without a logoff event of some kind. As long as they have an active session/process that was originally created while a member of the group, that session/process's context will continue to be a member of the group until it terminates. It's the same reason they need to logoff/logon to "activate" the group membership to begin with.

Now, there are plenty of ways to force a logoff at the pre-determined time. But I think that's about as close as you're going to get without modifying or augmenting the Windows security subsystem (with a 3rd party product for example).

1
  • Thanks, Ryan. I think I might just silently let them continue with admin perms until they log off...Just worries me as some users go days, even weeks in some cases without logging off.
    – Dustin F
    Aug 14, 2014 at 3:25
1

you can force the user to logoff at 30 min. mark. use Win32Shutdown with Flag 4, for force logoff.

That's the only way you can force the user to not have permission after the required time.

Also, if you could show a timer to the user telling them how much time they have left would be useful for them so that they could save what ever they were doing and not mess up anything.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .