Solved

How to logoff user form a Win 7 client per command remote?

Posted on 2014-11-13
21
36 Views
Last Modified: 2016-06-15
Hello Experts,

which command can a domain-admin use to logoff remote a user from a Win7 64 bit client?
Under WinXp "PsShutdown -o -f \\Client" worked fine but under Win7 not.
The attempt "PsExec \\Client shutdown -l" doesn't work too.

Many thanks for your help in advance.
0
Comment
Question by:hengi
  • 8
  • 5
  • 5
  • +1
21 Comments
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 40440751
shutdown /l /f /m \\client

does that work?
0
 
LVL 6

Expert Comment

by:Rob G
ID: 40440761
psexec \\computername cmd
shutdown -f -s -t "00"

Works for me..
It's one extra step but it does work..
0
 
LVL 53

Expert Comment

by:McKnife
ID: 40440859
Type
rwinsta /?
0
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 40440870
shutdown with -s will turn off the computer
the author asked for log off only
0
 
LVL 6

Expert Comment

by:Rob G
ID: 40440876
Oh my bad, misread it.. Thanks Seth..
0
 

Author Comment

by:hengi
ID: 40440943
Dear Seth,

unfortunately shutdown -l doesn't work together with -m \\client.

Dear Rob,

a shutdown or a reboot works with "psesxec \\client shutdown -s" or  "psesxec \\client cmd shutdown -s" and also with "psshutdown -s \\client". But all commands don't work with the flag only to logoff the user without reboot or shutdown. The command "psexec \\client cmd shutdown -l" returns "Forbidden function.(1)" and the command "psshutdown -o \\client" returns "Console logoff initiated on client." but nothing happens.
0
 
LVL 6

Expert Comment

by:Rob G
ID: 40440946
Hengi,
Does shutdown /L work?
instead of shutdown -l ?
0
 

Author Comment

by:hengi
ID: 40440997
Dear McKnife,

RESET SESSION SessionName /SERVER:client returns "Error: 1722 The RPC-Server is not available."
I thought this command would be for TerminalServices.
0
 
LVL 6

Expert Comment

by:Rob G
ID: 40441012
Wait! Terminal services?
Why don't you just use the Terminal server manager console?

If you don't have it, download the admin tools for windows 7 and call it a day..
0
 

Author Comment

by:hengi
ID: 40441017
Dear Rob,

unfortunately "shutdown /L" doesn't work too. I get the same Error "Forbidden function.(1)".
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 6

Expert Comment

by:Rob G
ID: 40441031
http://www.microsoft.com/en-us/download/details.aspx?id=7887

If this is a Terminal service environment,
just use the admin tools..


I thought this was for just random desktops on your network..
Alternately,
You can use group policy to force that clients only be allowed to log off, vs disconnect, which might help your cause..
0
 

Author Comment

by:hengi
ID: 40441034
Dear Rob,

no sorry this is not a TerminalServerSession. It's a normal Win 7 Client with a interactive login from a user.
0
 
LVL 53

Expert Comment

by:McKnife
ID: 40441558
rwinsta is not only for terminal servers/terminal sessions but for any session type on any windows OS.
If it does not work, then you either have no network connectivity to execute remote commands (firewall?) or you don't use an account that is member of the admin group of the remote system - or both.
0
 

Author Comment

by:hengi
ID: 40442333
Dear MacKnife,

ok, I thought rwinsta is for terminal server/terminal sessions. Good to know, that not. A domain-admin account, which is member of the loacal administrator group of the remote client, tried this command but got an error: "Error: 1722 The RPC-Server is not available." Other remote commands work, so I think it can't be the Firewall or use this command a special port?
0
 
LVL 53

Expert Comment

by:McKnife
ID: 40442350
"Other remote commands work" - for example which command works, if I may ask?
0
 

Author Comment

by:hengi
ID: 40443850
Dear McKnife,

For example: PsKill, PsLoggedon, PsList, PsPasswd, PsService, ... and also PsShutdown but this command only for reboot and shutdown the client
0
 
LVL 53

Expert Comment

by:McKnife
ID: 40444433
Those mentioned use RPC as well, I wonder why qwinsta should fail then while those work.
Please see what ports are open. Test with telnet:
telnet targetsystem 445
telnet targetsystem 135
If the screen goes black, the port is open.
0
 

Author Comment

by:hengi
ID: 40447458
Dear McKnife,

both commands return "connection failure". In the firewall port 135 and 445 are allow for the domain.
0
 
LVL 53

Expert Comment

by:McKnife
ID: 40447506
You mean, at the targetsystem, 135 and 445 are both allowed for incoming connections in the firewall profile "domain"? That would mean, something in between is blocking the access, another firewall.
0
 

Accepted Solution

by:
hengi earned 0 total points
ID: 40455624
Dear McKnife,

correct both ports are allowed for incoming connections. Up to now I couldn't find out what is blocking the access. But in the meantime I found also an other solution with powershell that works to logoff an user:

$Client = read-host "Client"
(gwmi Win32_OperatingSystem -ComputerName $Client).Win32Shutdown(4)

I can good live with this workaround.

Thanks all for tips and help.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Asus ks2003 driver XP 32 33 67
pdf to word 13 56
Adding proxy setting to Internet explorer 4 19
Electric Violin to Computer 4 10
The article will include the best Data Recovery Tools along with their Features, Capabilities, and their Download Links. Hope you’ll enjoy it and will choose the one as required by you.
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup". After a while, you have entered a loop for Auto repair which does not fix anything and you will be in a  panic as all your work w…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now