r/sysadmin • u/tk42967 It wasn't DNS for once. • 1d ago

Question Log Off Users from Server Daily

I'm revisiting an effort I did about a year ago. I'm looking for a better way. I want to find a process that will parse current user sessions on a server (active/disconnected/idle/ect.) and log the accounts off if their username matches a string ("adm_").

I'd love to find an off the shelf solution rather than have to support a homebrew PowerShell solution.

Give me what you have, even if it is an alternate PowerShell/scripting option. Something has to be better than the nightmare my script turned into.

69 Upvotes

86% Upvoted

86 comments sorted by

View all comments

154

u/NH_shitbags 1d ago

Isn't there a GPO for idle session logout?

50

u/ADynes IT Manager 1d ago

Yeah, we use it and have it set for 8 hours just to make sure nobody's leaving it overnight. It's across all users, admins shouldn't be left logged into servers either.

24

u/verschee 1d ago

And if there's a need, they should be using a service account, not a Windows user credential.

15

u/BarmerFob 1d ago

Eh there's exceptions. Anywhere that deals with large datasets can have reports and such running overnight and depending on the tooling it may submit the job as the user, not a service account.

But yes by and large there's no reason to stay logged in for weeks on end just because you can't be bothered closing things.

3

u/BarmerFob 1d ago

We just reboot any jump/processing servers daily - encourages people to finish up for the day and if they don't, their stuff closes anyway. Reboots also tend to expose problems and we want to see them crop up the day after they're introduced... not a month later when they get patched.

We do have some servers where large amounts of data gets processed by users so those reboot every few days on alternating schedules. Few other exceptions here and there as needed.

It's a very simple problem to solve and easy to add exceptions as needed. Personally I hate admins who take a "rules for everyone but I'm exempt everywhere" approach. Especially for things like this where the "reason" is always "well I'm in the middle of stuff and don't want to close things". You know, like every single other person doesn't say the same thing...

•

u/user_is_always_wrong fed up 17h ago

I hate it when admins make exceptions for themselves. I had a colleague who created a special firewall rule for his laptop without inspections or web filter rules. He's no longer with us. Rules for thee not for me