Locked Computers

[Davit2005]

We don't allow students to lock via policy but staff have the option.

 

We have enough problems with the staff when they leave them selves logged in, forget and then change their password. Although this has been less due to the fact we shut desktops down every night.

[LeMarchand]

Rebooting may not be desirable as it could result in lost work - hence the script above.

 

Luckily(?) Primary/Junior schools for me. They leave it logged on and walk away, tough luck if they lose their work.

[mavhc]

I am curious though how does it work as you can only have two simultaneous connections only (by default). a single computer could be logged onto on average by 6-8 different users a day. if two of those lock their sessions then you will have to reboot or disconnect the users anyway

 

Surely they're not simultaneous, doesn't that refer to remote connections?

 

- - - Updated - - -

 

Then again... there is another way that preserves the best of both worlds. I've attached my UnlockWorkstation script.

 

This script can remotely - and without any third-party tools - unlock a Windows workstation. Again, it assumes you are logged on as a domain admin and the workstation is domain-joined.

 

UnlockWorkstation computername

 

That's cool, how does it work?

[Steve21]

EduRemote (In my sig) is what we used at last school where we didn't allow switch users.

 

Here though Switch is enabled so just log on and kick off "if" required.

 

Steve

[Ephelyon]

That's cool, how does it work?

 

Open it with Notepad and find out!

 

But the top and bottom of it is that LocalSystem can switch anyone's session to the console...

[mavhc]

So the @ means be less verbose

^ means escape character

 

qwinstsa lists all sessions, the find just returns the console session

tokens=3 extracts the 3rd token, if there's a user logged in, that's the session number. if not it's "conn", which will make the rest fail I assume

 

tsdiscon disconnects the session, returning to the login screen

 

ping is for a delay?

 

a service is created that connects the console to that session, it's then started, and deleted

 

Surprising that works really, seems like a slight information exposure flaw, bet not many people know that another admin can unlock your screen

[Ephelyon]

Completely correct!

 

... except for the tokens bit. It extracts the session ID from the output of qwinsta. Tokens are separated by space/tab by default, so if you run qwinsta on a workstation you'll see where it's getting it from. It's looking for the part of the line returned by find that includes "console" (one session is always at the console).

 

And yes, even an admin is not supposed to be able to switch to a user and thereby impersonate them without knowing their password. But if you ask Microsoft, they'll eventually admit that "this behaviour is by design" because LocalSystem is indeed supposed to be able to do anything - that's its point. I imagine it's fixable if they reworked certain token/permission frameworks a bit, but they don't seem to be very interested in fixing it. Tested on XP up through 10 so far.

[mrforgetful]

Whilst I would just Switch User, it is possible with AB Tutor to send a Lock command and then Unlock. This is intended to be used to get a students undivided attention but we've found it will also unlock a computer left logged in by a user. Can be useful if it's an office machine with work files left open that you need to do something on.