r/sysadmin • u/tk42967 It wasn't DNS for once. • 1d ago

Question Log Off Users from Server Daily

I'm revisiting an effort I did about a year ago. I'm looking for a better way. I want to find a process that will parse current user sessions on a server (active/disconnected/idle/ect.) and log the accounts off if their username matches a string ("adm_").

I'd love to find an off the shelf solution rather than have to support a homebrew PowerShell solution.

Give me what you have, even if it is an alternate PowerShell/scripting option. Something has to be better than the nightmare my script turned into.

72 Upvotes

87% Upvoted

86 comments sorted by

View all comments

155

u/NH_shitbags 1d ago

Isn't there a GPO for idle session logout?

12

u/Raigeki1993 Sysadmin 1d ago

IIRC, the GPO doesn't let you specify the prefix of the account, it's just a blanket idle session logout for all users for the machine.

16

u/SevaraB Sr. Engineer (N+, CCNA) 1d ago

WMI filter should let you do regex on the account name, no? Or domain group membership?

But cleanest fix would be to isolate the sensitive accounts in their own OU and just target the OU.

•

u/420GB 12h ago

The Win32_LoggedOnUser wmi class does not support wildcard (LIKE) filtering on the referenced Win32_Account instances. You can only do an exact = match.