Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to delegate the right to log other users off? I'd like to give users the ability to log another user off of a computer, but I'm not willing to make everyone administrators to do so. We are currently on an 03 domain but are in the process of upgrading to 08. I know I can create a scheduled task to log the user off after a certain idle time, but don't really like that solution either.

I'm not talking about servers. I'm talking about standard client PCs (XP and 7) out in the house and I want average users to be able to log other average users off.

share|improve this question
    
Have you had a look in the Terminal Services Configuration section of the TS? –  Bart De Vos Jan 24 '12 at 14:28
    
I'm not talking about a Terminal Server. :) –  Shawn Jan 24 '12 at 14:48
    
Are you talking about users logged into the servers? If not, what OS are you / will you be running on the clients? –  Harry Johnston Jan 25 '12 at 2:49
    
XP and 7, updated question. –  Shawn Jan 25 '12 at 14:30
    
Windows 7 supports user switching even when the machine is joined to a domain; this mitigates the problem somewhat (but does not eliminate it completely, because there may be applications left running in the other session which block some resources). –  Sergey Vlasov Jan 25 '12 at 14:40
show 3 more comments

3 Answers

up vote 2 down vote accepted

This replacement GINA should work for XP: http://www.paralint.com/projects/aucun/

Windows 7 I should be able to create an "on idle" task to log off the users after a certain idle time, which will at least unlock the computer eventually.

share|improve this answer
add comment

Had the same problem as you. It seems like a third party application called Unlock Administrator that lets you do just that. You can set exactly which users (even standard users) can unlock a system. There is an option to log off the user instead of just giving them access to the session. There is a separate version of XP and Vista/7

share|improve this answer
add comment

The simple answer is "No". There is no way to do this without giving them local administrator privileges.

The only two solutions that I'd know of that might help you here are the following:

You could prevent them from locking the workstations in the first place. Under User Config>Administrative Templates>System>ctrl alt del options you can remove "lock computer. Of course that might rise some security concerns...

On Domains you can enable Fast User Switing which may help maneuver around the Problem quite well.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.