abillybob Posted January 5, 2016 Posted January 5, 2016 How do you guys deal with this? When a student fails to log off and then the computer locks so that machine then needs to be turned off by the power button so someone else can login again. I have also noticed that before the client computer used to show the username who is locked but now it doesn't? I'm sure it's probably something I've changed in GP but I don't know where to look - can anyone lend a helping hand!? Thanks
sonofsanta Posted January 5, 2016 Posted January 5, 2016 What OS are you on? (You've posted in 2008R2, but I assume that's for your DC, not your clients ) If it's Windows 7, follow this guide to restore the Unlock functionality: https://4sysops.com/archives/restore-administrative-unlock-to-windows-7/ Used that here since we switched to Windows 7 without any troubles, and I know others here use it as well.
abillybob Posted January 5, 2016 Author Posted January 5, 2016 Press switch user. Simple. Don't have that option - guessing it's disabled somewhere in GP but I can't find it! What OS are you on? (You've posted in 2008R2, but I assume that's for your DC, not your clients ) If it's Windows 7, follow this guide to restore the Unlock functionality: https://4sysops.com/archives/restore-administrative-unlock-to-windows-7/ Used that here since we switched to Windows 7 without any troubles, and I know others here use it as well. Thank you. Seems pretty simple to do though I'm worried about applying this as in the comments it says it prevents other GPO being applied to the machines!? Do you think this method would work with my current setup? What about Windows 8.1 though? It's Windows 7 we're running
witch Posted January 5, 2016 Posted January 5, 2016 Yeah, but I'm hijacking as I run windows 8 on the tablets the children use and I have this problem ALL THE TIME
abillybob Posted January 5, 2016 Author Posted January 5, 2016 Yeah, but I'm hijacking as I run windows 8 on the tablets the children use and I have this problem ALL THE TIME How... Very... Dare... You! 3
mavhc Posted January 5, 2016 Posted January 5, 2016 Perhaps: Computer Configuration/AdministrativeTemplates/System/Logon/Hide Entry Points for Fast User Switching Also lock screen is disabled for pupils here, there's pros and cons for that
kearton Posted January 5, 2016 Posted January 5, 2016 If you've got Impero (?) you can use this to unlock PCs.
LeMarchand Posted January 5, 2016 Posted January 5, 2016 Yeah, but I'm hijacking as I run windows 8 on the tablets the children use and I have this problem ALL THE TIME Don't use it on tablets, but on the desktops we have you can switch user.
sonofsanta Posted January 5, 2016 Posted January 5, 2016 Thank you. Seems pretty simple to do though I'm worried about applying this as in the comments it says it prevents other GPO being applied to the machines!? Do you think this method would work with my current setup? I set this up three and a half years ago and I have never once had a single problem that could be traced back to it. It's been completely fire & forget in that regard, although very useful on a regular basis
FN-GM Posted January 5, 2016 Posted January 5, 2016 Don't have that option - guessing it's disabled somewhere in GP but I can't find it! Its a computer GP called fast user switching.
sllorep Posted January 5, 2016 Posted January 5, 2016 I set this up three and a half years ago and I have never once had a single problem that could be traced back to it. It's been completely fire & forget in that regard, although very useful on a regular basis +1 for the Administrative Unlock add-in. We've been rolling it our at build stage (SCCM) for 3-4 years, and no issues so far. I have created a user in AD that then has Local Admin privilages on each PC, but i have denied logon with "Computer Configuration > Policies > Windows Settings > Local Polices/User Rights Assignment > Deny log on locally" so ICT teachers can use this account to log off locked pc's and i can change the password pretty quick if someone has found the password.
rad Posted January 5, 2016 Posted January 5, 2016 If you RDP to the computer it will go back to the log on screen, this then allows a user to log on (or at least get to the shut down option)
Driftingashore Posted January 5, 2016 Posted January 5, 2016 Freeloading off the benefit of being a small school here, so most IT rooms are supervised.. anyway, students simply aren't able to lock their PCs, and the PCs won't lock automatically if a student is logged on even if the PC sleeps. It's considered their responsibility to ensure they don't leave their computers unattended, just as it's mine to have solid backups. I'll take the lack of hassle on a daily basis and the possibility of having to restore work from a backup on the odd occasion (happened perhaps two times so far in as long as I can remember) over anything else. The teachers are the worst at locking their PCs and walking off
abillybob Posted January 5, 2016 Author Posted January 5, 2016 You guys are huge leg ends!!! Thank you for all the advice and info!! I'll look into them all
win Posted January 5, 2016 Posted January 5, 2016 Press switch user. Simple. ^ recommended It's a setting in the GP somewhere - works well in these situations
Ephelyon Posted January 5, 2016 Posted January 5, 2016 (edited) @abillybob, for individual cases, you can use this script from your desk (assuming you're logged on as a domain admin) at the command line to switch a locked workstation back to the logon screen without disturbing the inactive session. SwitchToLogon computernameSwitchToLogon.zip Edited January 5, 2016 by Ephelyon
3s-gtech Posted January 5, 2016 Posted January 5, 2016 You can also run shutdown -r -m \\computername from a DC or similar to force a soft restart. AB Tutor Control allows you to do it in the same way as Impero.
dapaulio Posted January 5, 2016 Posted January 5, 2016 What OS are you on? (You've posted in 2008R2, but I assume that's for your DC, not your clients ) If it's Windows 7, follow this guide to restore the Unlock functionality: https://4sysops.com/archives/restore-administrative-unlock-to-windows-7/ Used that here since we switched to Windows 7 without any troubles, and I know others here use it as well. +1 for this solution. we have had this in place for as long as I can remember and works really well. my only gripe is it can take two or three seconds to acknowledge a staff member credentials where in that time you question whether it has worked. may not sound long but it is long enough to confuse staff. I think if I recall it requires staff to have local admin priveleges on the computers. this may be a deal breaker for you if you are not convinced on this fix then you could rdp on to the client and log off the user manually using task manager. however this would require doing work and we all know we don't like additional work
dapaulio Posted January 5, 2016 Posted January 5, 2016 You can also run shutdown -r -m \\computername from a DC or similar to force a soft restart. AB Tutor Control allows you to do it in the same way as Impero. this works also however can I advise also using the -f (force) and -t (time delay) switch for a more effective remote reboot. eg. shutdown -r -m \\computername -t 0 -f
Ephelyon Posted January 5, 2016 Posted January 5, 2016 Rebooting may not be desirable as it could result in lost work - hence the script above.
dapaulio Posted January 5, 2016 Posted January 5, 2016 Rebooting may not be desirable as it could result in lost work - hence the script above. normally I would agree. for a member of staff that is left logged in where the possibility is they are likely to return, but a student who has a set timetable and is likely never to return until their next lesson in a couple days or weeks, you are just tying up resources on a computer for a user that is never going to return until the computer is next shutdown at the end of the day where they are likely still to lose work if they have any unsaved. your just prolonging the inevitable. I am curious though how does it work as you can only have two simultaneous connections only (by default). a single computer could be logged onto on average by 6-8 different users a day. if two of those lock their sessions then you will have to reboot or disconnect the users anyway
Ephelyon Posted January 5, 2016 Posted January 5, 2016 It basically just uses "tsdiscon" to disconnect the locked session from the console - Windows will then return to the WinLogon session (logon screen) by default. Horses for courses - sometimes they do come back, or it could be a member of staff who will be back after lunch in half an hour (having set up all their lesson content ready) but it would be nice for someone else to just get on and do something quickly in the meantime. Either way, it's probably better if it's not IT's decision - the new user can decide whether any performance drop is reason enough to do a clean restart (i.e. not through the power button), then it's their fault if anything's lost... That probably sounds more cynical than I meant it to, but oh well!
Ephelyon Posted January 5, 2016 Posted January 5, 2016 (edited) Then again... there is another way that preserves the best of both worlds. I've attached my UnlockWorkstation script. This script can remotely - and without any third-party tools - unlock a Windows workstation. Again, it assumes you are logged on as a domain admin and the workstation is domain-joined. UnlockWorkstation computernameUnlockWorkstation.zip Edited January 5, 2016 by Ephelyon 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now