Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What's the best way to allow an administrator access to a locked user XP session, preferably with a logged event? The goal is to allow admins to cleanly shutdown/save existing work when work needs to be done on the PC. I am aware of the various VNC software flavors, but that only works when the PC is unlocked. Resetting the user password on the DC doesn't work either since the unlock password is cached locally, which means you still have to log the user out and possibly lose work.

share|improve this question
up vote 2 down vote accepted

I have not tried it personally but there is this:

share|improve this answer
More out of curiosity than anything else I'm going to have a play with that idea but I expect any half decent AV software to object strongly to such techniques. Making an exception in the AV config would create a rather large security hole. I suppose it could just be disabled temporarily while the unlocking is taking place. – John Gardeniers May 6 '10 at 21:25
Wait, what? The AV software shouldn't do anything. Any good AV software in any case. If anything it would complain during the install of it, and after that it should be fine. If you had to add the exception for this application, it wouldn't be any major security risk. If it is a good AV, it shouldn't allow, for example, "xpunlock.exe" from a malicious user because it should store a hash of the legit application and block all others. That is of course, if you have a good AV. – Nathan Adams May 6 '10 at 23:23

W/o a clever hack (described by Nathan) windows intentionally makes this difficult.

They way I read about it, When you login windows create a security token to lock your 'login session' handle, and it's only accessible from the user who created the security token. Administrators can only discard this token, they cannot access it. (I may be getting the terms wrong, it's been a while since I read this)

Even the RemoteUnlock tool described by Nathan admits it doesn't "Really" unlock the workstation, it just 'tricks' windows into switching back to the 'default' desktop; the security system on windows still thinks it's locked.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.