6

We have mission-critical Windows 7 workstations on our network that must be available to any user at any time, even when it has been locked by a prior user. Thus, we have fast user switching enabled. Unfortunately, it's not unusual for us to have a dozen or more different users logged onto the same machine at the same time, with a corresponding degradation in service.

We've done our best at educating the masses to log off at the end of their shift. But users being users, this does not happen on a consistent basis. Does anyone know of a clean way to force logoff idle users after a certain amount of time has elapsed? I am open to any method that could be deployed/configured via script, GPO, or SCCM.

newmanth
  • 3,943

4 Answers4

2

You can setup a GPO to push out a scheduled task that would run this program for all users or if it's just the one system simply make a scheduled task for all users.

Devin Rawlek
  • 71
  • 7
  • Looks to me as though that script only works if the computer is idle, and not necessarily a user account. – DKNUCKLES Dec 14 '12 at 03:36
  • From the tests I've ran (Compiling code in Visual Studio, Pulling data from Git, Running a 3DMark) it would lock only if the user didn't provide input.

    Running it at start up (logon script) will allow you to achieve the result you want by setting the timeout to say 1 hour. That should be a safe amount of time to assume the user is no longer using the system.

     – Devin Rawlek Dec 14 '12 at 04:21
  • Thanks Devin. Unfortunately, that site is blocked by my company. Due to the sensitive nature of our network, we are severely restricted on the third party applications that we can use. Ideally, any type of mechanism where we can see how it actually works (i.e. script or source code) would be preferred. – newmanth Dec 14 '12 at 17:03
1

You could try setting everyone's permitted logon hours from 12:00am to 11:59pm (notice the one minute gap), with forcible logoff configured (in gpedit > Computer > Windows Settings > Security Settings > Local Policy > Microsoft network server: Disconnect clients when logon hours expire). That way, everyone who is logged on to any computer will be forcibly logged off at 11:59pm. However, this may not work in your scenario, depending on how unpredictable your user's work times are.

Bigbio2002
  • 2,843
  • 12
  • 36
  • 56
1

@Bigbio2002, this does not log off users. The Disconnect Clients when Logon Hours Expire is for servers - when users are connected with SMB, this setting will disconnect users connected to that server. It does not log off interactive Windows sessions.

The best way to do this is to set up a GPO with a Scheduled Task that logs off the user. GPME/UserConfig/Pref/CtrlPanelSettings/ScheduledTasks. The only caveat is that you can only apply this to OUs, but if you're AD is organized, this should work well.

Orca James
  • 11
0

I have contributed a small application that force logout users after a configurable timeout for that very purpose, I could not find any good solution so I made one myself, very simple but the only that worked so far.

Code and binaries are available on gitHub: https://github.com/lcoulet/windows_AutoLogoff

I hope this helps.

Loic
  • 101