Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to make windows clients automatically log off after some time, I have been trying to use the winexit.scr which I have seen working else where in a similar environment.

After working though these instructions (I did read the comments and notice the original ADM provided is buggy) I've had no joy what so ever! Winexit.scr refuses to read any settings in the registry, even while using a test account I can access the required reg key(s); edit, add, and remove values.

Essentially winexit.scr always uses it's default values: 30 second timeout, no forced log-out. What I really want is a 30 minute timeout with a forced log-out, closing all the users apps etc.

I've tried removing and re-adding the ADM template, creating the GPO from scratch several times, giving various registry permissions - including full control to "Everybody" just for fun!

Oh, clients are all win XP SP3, DC is win 2003 R2 SP2.

So, can anybody suggest something?


share|improve this question

I had to implement a similar solution in the same kind of environment (Server 2K3 / Win XP) and the definitive guide that I found was located at a little Wordpress Blog. I highly suggest that you follow his narrative, from searching for a solution through implementation and troubleshooting.

The only other suggestions I have for you are that you check the permissions on the registry values as, by default, they only work for administrators.

share|improve this answer

You could try using the logoff.exe or shutdown.exe (with the -l flag of course) as the idle-timeout screensaver

In order to do this (such that it takes the windows screensaver arguments properly) you would need to create a script that would accept the screensaver arguments defined here primarily focusing on the /s flag


Logoff command kicks off (logging off) the specified remote session. Log off help shows,

C:>logoff /?
Terminates a session.

LOGOFF [sessionname | sessionid] [/SERVER:servername] [/V]

  sessionname         The name of the session.
  sessionid           The ID of the session.
  /SERVER:servername  Specifies the Terminal server containing the user
                      session to log off (default is current).
  /V                  Displays information about the actions performed.


C:>logoff /server:infra-apps 1 /v
Logging off session ID 1


Usage: shutdown [/i | /l | /s | /r | /g | /a | /p | /h | /e] [/f]
    [/m \\computer][/t xxx][/d [p|u:]xx:yy [/c "comment"]]

    No args    Display help. This is the same as typing /?.
    /?         Display help. This is the same as not typing any options.
    /i         Display the graphical user interface (GUI).
               This must be the first option.
    /l         Log off. This cannot be used with /m or /d options.
    /s         Shutdown the computer.
    /r         Shutdown and restart the computer.
    /g         Shutdown and restart the computer. After the system is
               rebooted, restart any registered applications.
    /a         Abort a system shutdown.
               This can only be used during the time-out period.
    /p         Turn off the local computer with no time-out or warning.
               Can be used with /d and /f options.
    /h         Hibernate the local computer.
               Can be used with the /f option.
    /e         Document the reason for an unexpected shutdown of a computer.
    /m \\computer Specify the target computer.
    /t xxx     Set the time-out period before shutdown to xxx seconds.
               The valid range is 0-315360000 (10 years), with a default of 30.
               If the timeout period is greater than 0, the /f parameter is
    /c "comment" Comment on the reason for the restart or shutdown.
               Maximum of 512 characters allowed.
    /f         Force running applications to close without forewarning users.
               The /f parameter is implied when a value greater than 0 is
               specified for the /t parameter.
    /d [p|u:]xx:yy  Provide the reason for the restart or shutdown.
               p indicates that the restart or shutdown is planned.
               u indicates that the reason is user defined.
               If neither p nor u is specified the restart or shutdown is
               xx is the major reason number (positive integer less than 256).
               yy is the minor reason number (positive integer less than 65536).

Also, in the case of using logoff.exe, a benefit could be that it can be executed by a system level service that monitors the idle timer and logs off users accordingly by passing it the console session id.

Note that this implementation would probably require the use of at least a bit of programming

share|improve this answer
You can use a logonscript that executes logoff.exe after a delay. – ZEDA-NL Apr 10 '12 at 15:27

An alternative is to create an MSI package with the files and the registry settings required, then apply the msi in AD using a computer policy for software distribution. This avoids having to fiddle with administrative templates.

I'd use visual studio, although there's probably some other good free & 3rd party tools that will do the same thing for you.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.