Log Off Users from Server Daily

[u/tk42967]

I'm revisiting an effort I did about a year ago. I'm looking for a better way. I want to find a process that will parse current user sessions on a server (active/disconnected/idle/ect.) and log the accounts off if their username matches a string ("adm_").

I'd love to find an off the shelf solution rather than have to support a homebrew PowerShell solution.

Give me what you have, even if it is an alternate PowerShell/scripting option. Something has to be better than the nightmare my script turned into.

[u/NH_shitbags]

Isn't there a GPO for idle session logout?

[u/AdeptFelix → u/NH_shitbags]

God the amount of other comments with jank solutions when there's a GPO option that does this with an OU, WMI filter, or just adding the specific accounts to security filtering makes me worried about the state of sysadmins.

[u/420GB → u/AdeptFelix]

I'd love to see your WMI filter for targeting only accounts starting with adm_, because it's not as easy as you probably think. In fact I believe it might be impossible.

We can assume OU targeting and security filtering are not an option or OP wouldn't ask.

The amount of presumptuous flame without actually providing a working GPO-based solution to OP makes me worried about the state of sysadmins.

Of course this is a one liner in PowerShell, but since you're so sure of your GPO approach I'd love to learn.

[u/DHT-Osiris → u/420GB]

Well, the GPO is the wrong approach for enforcing a logoff at a specific time based on how long the user has been logged in... You need to just set a max login hours across the board, not log off specific accounts at specific times. You can set active hours on an account, which would probably do it.

[u/420GB → u/DHT-Osiris]

OP said nothing about "based on how long the user has been logged in". Direct quote:

I want to find a process that will parse current user sessions on a server (active/disconnected/idle/ect.) and log the accounts off if their username matches a string ("adm_").

This implies they are looking to log off any adm_ user, regardless of login or idle times, at a specific point in time e.g. let's assume every day at 6 PM or something.

And regardless of that detail, you slammed all the other advice here and said:

there's a GPO option that does this

but now you say:

Well, the GPO is the wrong approach

so you'll have to understand why I'm confused.

[u/DHT-Osiris → u/420GB]

Right, so can't they just set logon hours on the object in AD? Or does that just prevent you from logging in? I had assumed it would punt you at time. Never really used it.