1

W2K3 AD domain, XP Pro workstations.

User A logs in to a computer, walks away, screen gets locked. User B wants to use that computer. Current options are to find someone that knows the admin password to forceably logoff user A's session, or hold the power button until the machine turns off and then wait for it to boot back up again.

I would like to allow members of the Domain Users group to force a logoff the way Domain Admins can. Is this possible?

Improve this question

3 Answers 3

Reset to default
1

I believe that in order to forceably log off another users your require local admin rights. I've never seen a way a normal user can do it. I can see too many potential problems if that wasn't the case.

One possible workaround is to have an admin send a remote log-off command. You may like to investigate psShutdown for that. You could create a batch file that prompts for the computer name and then sends the command. In that case the user wanting to use the machine only needs to make a phone call to the admin. An added advantage is that at least one admin is then aware this is happening.

Improve this answer
1
  • I will add a user to the local Administrators group and see if they can force logoff another user. This is a small company and there isn't an admin on site most of the time, so making a phone call isn't really an option.
    – Lance Lefebure
    Jul 31, 2009 at 15:12
2

I would like to allow members of the Domain Users group to force a logoff the way Domain Admins can. Is this possible?

Unfortunately not that easily. What you need to do is create a domain group (CanLogOffUsers), and manually add that group to the administrators group on the PC's in question. This, of course, means those users are administrative users if they actually login to use the machine.

We have a small IIS intranet site that allows users to select a workstation from a list -- and click a link that executes psshutdown (on the server, via PHP) against the machine to gracefully log the user off.

Improve this answer
1
  • I was going to suggest that myself. Then the user could just login to another work station and do it that way or have a co-worker do it. Just make sure it logs who ordered the shutdown or you might get the practical jokes going.....Hey bob hasn't save that document yet he's been on all morning....watch this hehehe. Course that could be a perk to it.
    – SpaceManSpiff
    Jul 31, 2009 at 12:40
1

As for me I would log off users after some period of inactivity.

For that one can use 'winexit.scr' from Windows Server 2003 Resource Kit Tools as a screensaver. support.microsoft.com/kb/314999 describes how to use it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .