Solved

Force User Logoff  immediately  -- User logged on to my Windows 2000 Server

Posted on 2003-11-19
7
779 Views
Last Modified: 2013-12-04
My office manager has been tasked with terminating personnel.  As the IT Administrator, I am tasked with disabling the user account in Active Directory and forcing the user the logoff immediately.

The bottom line is:  When instructed by the office manager, I want to prevent (immediately) all  access to the domain from the terminated employee's computer.

Thanks for your help.
0
Comment
Question by:jimdorman
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 10

Expert Comment

by:BloodRed
ID: 9783127
Locking out the account will cause the user to not be able to access any networked resources, so you can consider them isolated from the network.  You can set logon hours in the account's properties, and force logoff when logon time expires via Group Policy.  
0
 

Author Comment

by:jimdorman
ID: 9783213
Well, how do you lockout an account?  I searched the Windows 2000 Server help files and "lockout" only relates to Remoate Access or VPN accounts.

The only way I know to prevent immediate access to the server, is to go to my wiring closet and pull the cat5 cable that is connecting the terminated employee's computer to the router/switch.  However, the terminated employee may go to someone else's computer and log on.

Thanks again for your help.
 
0
 
LVL 10

Expert Comment

by:BloodRed
ID: 9783811
On either your DC or a managment workstation with the Admin tools installed, open Active Directory Users and Computers, find the user's account, right-click and select Disable.  The change will immediatly replicated to any other DCs in your AD domain and the user will not be able to access network resources.  
0
Why You Need a DevOps Toolchain

IT needs to deliver services with more agility and velocity. IT must roll out application features and innovations faster to keep up with customer demands, which is where a DevOps toolchain steps in. View the infographic to see why you need a DevOps toolchain.

 

Author Comment

by:jimdorman
ID: 9783972
Your suggestion worked partially.   I disabled my account through Active Directory on the DC.  I did not log off of my own computer.  I clicked on Outlook.  The Exchange Server did not display any messages in my Inbox (normally there would be about 50).  So by disabling the account, e-mail was disabled.

However, I opened Explorer.  I navigated to the mapped drive on the DC.  (This is where word processing documents are stored).  The DC Server allowed me to read, edit, and print all documents.
0
 
LVL 10

Expert Comment

by:BloodRed
ID: 9784239
Try enabling "Force logoff when logon hours expire" in Group Policy, then in the account properties in AD set the logon hours so that your test account isn't able to logon in the next half hour or so.  That should force you to log off.
0
 
LVL 5

Expert Comment

by:juliancrawford
ID: 9784848
Why not use shutdown.exe from the resource kit.
Once you have disabled the account in AD shutdown the users PC and they are gone.
0
 
LVL 1

Accepted Solution

by:
monsterrick earned 250 total points
ID: 9841509
Remote shutdown is a good idea but the user may already logged on from another machine which you don't know.
One more to try is launch "Computer Management" from the file server.  Open "Shared Folders".  Click "Sessions".  Find the user session, sort it by "User" and locate the user.  Then, delete his/her session(s) after you disabled this user account.
0

Featured Post

DevOps Toolchain Recommendations

Read this Gartner Research Note and discover how your IT organization can automate and optimize DevOps processes using a toolchain architecture.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As I write this article, I am finishing cleanup from the Qakbot virus variant found in the wild on April 18, 2011.  It was a messy beast that had varying levels of infection, speculated as being dependent on how long it resided on the infected syste…
Recently, I read that Microsoft has analysed statistics for their security intelligence report. It revealed: still, the clear majority of windows users do their daily work as administrator. An administrative account is a burden, security-wise. My ar…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question