5

I work for a school and a constant problem is staff leaving themselves logged on at workstations and leaving their sensitive materials exposed to other users and potentially students. I applied GP to lock the workstations via the screen saver but then i have another problem - staff leave shared PCs and the next person who wants to use the system can't unlock it.

I have other tech assistant staff in addition to the Sys Admins that do not and should not have full Administrator rights on the domain. Is there a way to (1) add these users to the Administrators group but somehow limit them from other administrative privileges or (2) somehow give their user accounts the permission to unlock workstations.

The problem as you can imagine is rectified by the tech assistant staff presently by hard-resetting the PC - not ideal.

Improve this question
2
  • 1
    Apart from the obvious idle logoff settings that can be applied, this sounds more like an educational matter (pun not intended) - have them take responsibility for leaving a locked workstation with no intention of getting back to it...
    – Oskar Duveborn
    Nov 23, 2009 at 7:59
  • 1
    You know Oskar, i agree 1000% but i am not in a position to enforce such social disciplines, even if on principal they should rank of higher importance. In my environment, social disciplines are not practical. Believe me, it sux more than you know!
    – cottsak
    Nov 23, 2009 at 8:20

6 Answers 6

Reset to default
4

As already explained, you do not need a domain admin to 'unlock' a computer, the user is only required to be a local administrator.

The best solution i think here is to automatically log out users that are idle for a certain period.
EDIT:

It's not a straight forward GPO and requires a bit of a kludge with modifying the windows screensaver. Here's what you do:

  1. Download the Windows Server 2003 Resource Kit Tools
  2. Copy the Winexit.scr out of the resource kit to the %systemroot%\system32 directory on each workstation
  3. Create a user GPO with the following settings: alt text http://img34.yfrog.com/img34/6015/mwsnap53020091124100617.jpg
- for screensaver executable name use:winexit.scr
- for screen saver time-out specify how log the idle time should be before logging out. This is in seconds.
Improve this answer
3
  • 1
    can you direct me to the GPO path/settings?
    – cottsak
    Nov 23, 2009 at 7:27
  • 1
    Be aware that forcibly logging people out may cause them to lose data if they have files open at the time. I'd suggest using another workaround.
    – Carl C
    Nov 23, 2009 at 23:20
  • 4
    Adding...I suppose you're having to kick them off anyway when you log them off as local admin. You're still more likely to lose someone's data by forcibly logging them off every time instead of just some of the time.
    – Carl C
    Nov 23, 2009 at 23:25
3

Adding the Domain accounts for your other tech assistants to the local Admins group on each PC should be all that's required.

Beware of unlocking though, as it will force the logged-on account to log off, close all their files, and potentially lose unsaved work. User education is really the only way.

Improve this answer
2

Other threads on this topic seem to indicate that you will need a third-party solution: Unlock Administrator looks useful and has a free trial, though I've never tried it.

Improve this answer
1
  • i would really love -not- to use a 3rd party tool
    – cottsak
    Nov 23, 2009 at 7:28
2

Several people here have mentioned an "idle timeout" setting that can be applied via GPO. To clarify, there is no "idle timeout" setting for users logged on to workstations, that I'm aware of. The setting that is being refereed to is relevant to Terminal Services sessions only.

If I'm off base, would someone kindly point me to the GPO or user account setting that is applicable? Thanks.

Improve this answer
1
  • i've used the TS timeout before but not thru group policy - just config in the Term Services snap in. i wouldn't hav thought the two could be confused so easily. i hope for my sake there is this GPO
    – cottsak
    Nov 23, 2009 at 16:30
2

I'd either go with Unlock Administrator, as others suggested, or do the following:

  • Create a Workstation Administrators Active Directory group.
  • Add your technicians to the Workstation Administrators group.
  • Add the Workstation Administrators group to the local Administrators group on the workstation.

When a PC is locked, they would need to call tech support (or the other user) to come unlock it. Alternatively, do the above install a remote control tool that runs as a service and have your technicians log on to the PC remotely and unlock it.

Improve this answer
1

You can use a GPO (using Restricted Groups or a startup script and the "NET LOCALGROUP" command) to add a domain user/group to the local Administrators group on domain computers.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.