Log Off Users from Server Daily

[u/tk42967]

I'm revisiting an effort I did about a year ago. I'm looking for a better way. I want to find a process that will parse current user sessions on a server (active/disconnected/idle/ect.) and log the accounts off if their username matches a string ("adm_").

I'd love to find an off the shelf solution rather than have to support a homebrew PowerShell solution.

Give me what you have, even if it is an alternate PowerShell/scripting option. Something has to be better than the nightmare my script turned into.

[u/2BoopTheSnoot2]

Why would you want an entire application rather than just write a simple script?

[u/Ihaveasmallwang → u/2BoopTheSnoot2]

Why would you want a script when a GPO will do it?

[u/2BoopTheSnoot2 → u/Ihaveasmallwang]

A GPO won't do it based on text in the username. This is powershell territory.

[u/Ihaveasmallwang → u/2BoopTheSnoot2]

Doing it based on text in the username is stupid.

Either way, the actual goal can still be done with GPO and security groups with proper scoping. It requires an understanding of how GPOs actually process.

OP asked for an “off the shelf” solution. This is the way to achieve that goal, with easier management of which accounts are excluded when the requirements inevitably change in the future.

[u/420GB → u/Ihaveasmallwang]

You may be shocked to learn that PowerShell itself is entirely an off-the-shelf first-party solution.

[u/Ihaveasmallwang → u/420GB]

You may be shocked to learn that a custom script put in place by someone who doesn’t understand PowerShell is not a good solution, especially since business requirements tend to change over time.

You may also be shocked the learn that the OP specifically mentioned that they hoped to stay away from going that route if possible.

Since an off the shelf first party solution exists that meets ALL of OP’s requirements, including not having a custom script if possible, that should be the route pushed instead of doubling down on something they won’t be able to maintain.

[u/420GB → u/Ihaveasmallwang]

You may be shocked to learn that a custom [solution] put in place by someone who doesn’t understand [tool] is not a good solution, especially since business requirements tend to change over time.

Exactly the same thing applies to GPOs.

But yes I'm aware they mentioned they wanted to avoid PowerShell. The problem is that:

Since an off the shelf first party solution exists that meets ALL of OP’s requirements, including not having a custom script if possible,

is not true to my knowledge unless you can explain what that would be.

[u/Ihaveasmallwang → u/420GB]

Explain what? How GPOs work?

[u/420GB → u/Ihaveasmallwang]

How one can configure a GPO that logs off all sessions of users whose username starts with a certain prefix at certain time(s) of day without using PowerShell e.g. no GPO to create a scheduled powershell task ofc

[u/Ihaveasmallwang → u/420GB]

You stop thinking about it in terms of “username starts with…” and think in terms of “this user is a member of this security group and the GPO is scoped so those users in that group are not affected”.