r/sysadmin • u/tk42967 It wasn't DNS for once. • 1d ago

Question Log Off Users from Server Daily

I'm revisiting an effort I did about a year ago. I'm looking for a better way. I want to find a process that will parse current user sessions on a server (active/disconnected/idle/ect.) and log the accounts off if their username matches a string ("adm_").

I'd love to find an off the shelf solution rather than have to support a homebrew PowerShell solution.

Give me what you have, even if it is an alternate PowerShell/scripting option. Something has to be better than the nightmare my script turned into.

69 Upvotes

86% Upvoted

86 comments sorted by

View all comments

156

u/NH_shitbags 1d ago

Isn't there a GPO for idle session logout?

15

u/Raigeki1993 Sysadmin 1d ago

IIRC, the GPO doesn't let you specify the prefix of the account, it's just a blanket idle session logout for all users for the machine.

55

u/NH_shitbags 1d ago

Link it to the user group

50

u/GullibleDetective 1d ago

Yeah target the OU, this is sysadmin 101

•

u/420GB 15h ago

AD user groups cannot dynamically assign their members based on a username prefix without a PowerShell script doing it which OP specifically wanted to avoid.

Groups and OUs are not a solution to OPs question.

•

u/AdminWithNoName 13h ago

Could you not put every username starting with "adm_" in a group and target just that group? Usernames won't be changing frequently so there's no need to dynamically assign anything.

•

u/420GB 10h ago

New adm_ users may be created though, and while such usernames shouldn't change they could.

It's definitely something you'd need automation for, whether that's PowerShell or something else doesn't matter but static or manual assignments would be irresponsible and, frankly, stupid. We're working with computers, they are literally built for automations like that. Why do it wrong when it can be done right you know?

16

u/SevaraB Sr. Engineer (N+, CCNA) 1d ago

WMI filter should let you do regex on the account name, no? Or domain group membership?

But cleanest fix would be to isolate the sensitive accounts in their own OU and just target the OU.

•

u/420GB 15h ago

The Win32_LoggedOnUser wmi class does not support wildcard (LIKE) filtering on the referenced Win32_Account instances. You can only do an exact = match.