Allow staff to unlock workstations logged in as a student

[cookie_monster]

3. Take a look at delegating teachers control over administering pupil passwords. You could create a custom MMC snap-in although this is probably the most complex method

 

I'm having a monday moment, how does that help?

 

 

EDIT

 

Ah in responce to rob_f, i must of missed that post.

[Guest Guest]

Not a great way i know but what about an account just for this task, with admin rights and a script which runs in the background and logs the user off again should a member of staff try to log on with them/.

[FN-GM]

Can you not just tell the staff to keep the power button held in? I know I know, not good.

 

Thats what i am trying to avoid

 

If you delegate the permission for staff to change passwords: Change their password, make a note on their account, and when they come to get their password reset let them know why it was changed and tell them not to do it in the future!?

 

That is an option but then it will need reseting again

 

How about creating a specific account teachers can use for this purpose?

 

Good idea. i could either lock down the account, make it so it can't logon any computers (will this actually let them unlock the machine though) or i could create a script to log the right off as soon as they login.

 

That will be the way forward if I can’t manage to give teachers the right to unlock machies with there own credentials.

[Guest theeldergeek]

Due the number of students wrecking others work. Students will often need to leave there computer. They say it’s a pain to log them off (I can’t blame them really) and will just leave them. We did originally have it set so they can’t lock them but due to popular demand from teachers, students and mainly SLT we allowed this.

 

To be honest its not to much of an issue us unlocking the workstations. Just would be more convenient for staff to be able to unlock them right away and more convenient for us not having to do it.

 

Any good?

 

Mr. Database » Force User Logoff after a Period of Inactivity

[stratisphere]

To be honest, you asked for a more Microsoft way of doing this... letting a "normal" user be able to unlock a desktop goes against the idea of having normal level accounts.

 

As far as I know, there is no true microsoft way to do what you ask.

 

If i had to solve this, my first concern would be to NEVER give any other users other than technical staff administrator access. Network nor local. you are just asking for trouble. Sure current staff may be trustful, but what if down the road one member of staff as a paddy or something?

 

Anyway, if I were to solve this, I'd create a program which would effectivly lock the desktop. Then a member of staff from their end would run another program which would speak to the first and unlock/log off.

 

But before all that, you need to decide something. Do you:

a) give teachers access to force a logoff but not allow them to simply unlock the user's desktop (this method is by far the most secure, but can result in lost work if it's not saved.)

b) give teachers access to unlock the desktop which would drop them back into the user's account. (This is by far the most insecure method. Personally, I wouldnt even think about it. You are still then depending on the member of staff to save that user's work).

 

Obviously I dont know anything about your site or situation. But please, for security reasons alone, considure the fact that all you need is one annoyed member of staff (or privileged user) to set the whole thing on fire. It's down to the common question. Security or convenience?

[mac_shinobi]

found this :

 

e-motional.com software -- Unlock Administrator for Windows 2000,XP,2003

 

would be good if there was an opensource equivelant

[stratisphere]

lol i just saw that. Tbh it's pretty easy (and if im reading right) wouldnt stop the normal SAS keys. Meaning a user could just come along and do ctrl-alt-del and have access to anything the original user could.

 

It's easy to make a prog to lock a user out and give x person/group control/options. It's another thing to lock windows and give security aswell. AFAIK there is no way to block ctrl-alt-del via a program unless you are physically hooked into the Gina (which requires either a custom gina or a hook on the MS gina).

 

I've looked into this in the past and writting your own gina isnt easy (Well, i lie, it is... it's just a pain in the ass to debug as if there is ANYTHING wrong, you get a BSOD with no useful info).

 

Saying that, im in the middle of writting one.

[stratisphere]

and i just downloaded that program and it does exactually what I just said above. It doesnt replace the gina (well yes it does) but it hooks into the original gina.

 

Unless you are willing to replace the gina... I dont think you are going to find the perfect solution to this.

[Bestbett]

I always just have the students that find a locked one press the power button to automate a shutdown then turn it back on and log in. It really is the most simple way of doing it, requires no change in gpo and they don't even have to wait on a staff member to fix it. Over time I even have less trouble with people locking it because everyone knows how to get around it.

 

Otherwise why couldn't you disable them locking and have them log off instead of locking? Either way it seems like more of a training issue solution than a software one.

[FN-GM]

why couldn't you disable them locking and have them log off instead of locking?

 

http://www.edugeek.net/forums/windows/19559-allow-staff-unlock-workstations-logged-student-2.html#post193810

[Guest theeldergeek]

To be honest, you asked for a more Microsoft way of doing this... letting a "normal" user be able to unlock a desktop goes against the idea of having normal level accounts.

 

As far as I know, there is no true microsoft way to do what you ask

 

Did you not see the link I posted? It won't prevent the workstation from being locked - which in itself isn't a bad thing as workstations DO need to be locked from time to time - but it does log the user off if they don't return to the machine after a determined time.

 

FWIW, I haven't tested it, but all the literature suggests it will do exactly what is required, and is from MS.

[stratisphere]

I saw it, but it's not a perfect solution as if a user still has work unsaved (or as he said earlier in the thread, if the user has a double period with lunch in the middle) then they will be logged off.

 

I was trying to find a solution for the whole thing. And as i said, Microsoft do not provide any solution (or mix of solutions) that would get the perfect outcome for this.

 

As for locking, i'm very aware that locking workstations is a good idea. I ensure staff do it when ever they leave their machines logged in (and are going back) but in an education environment, it's not practical for students as half the time they do it just to waste time in the lesson.

[K.C.Leblanc]

Could you set something up using PSSHUTDOWN remotely from the teacher PC.

[mac_shinobi]

David Carlin: Automatically log off users

[mrbill]

This is not a technical issue, it's a behavioral problem best fixed by changing the practice not by adding more technology to the problem. If you leave unsaved work on your system you deserve to have lost. Have that happen once or twice and behavior will change. Yes lock it when you leave but don't expect it to be their when you get back. Then if someone needs on the system use the the "Any Key" (Power Button) to continue.

[TheFopp]

This is not a technical issue, it's a behavioral problem best fixed by changing the practice not by adding more technology to the problem. If you leave unsaved work on your system you deserve to have lost. Have that happen once or twice and behavior will change. Yes lock it when you leave but don't expect it to be their when you get back. Then if someone needs on the system use the the "Any Key" (Power Button) to continue.

 

Absolutely agree. If the can't be bothered to save work and log off, then its their own problem. Surely ICT lessons teach them that this is best practice for keeping work safe and secure.

 

For the sake of 20 seconds to log off and 20 to log on, it seems like you're creating a lot of work for yourself over nothing.

[Mr.Ben]

How about not allowing pupils to lock the workstation and getting the staff member to lock the room when they leave for lunch?

[BBrian]

What happens if you reset a password while a user is logged in?

[rvdmast]

Thanks John. Some weeks back i've spent days googling and searching for a preferably free/open source solution for this and all i could come up with was

a commercial product called Unlock Administrator. Good thing i havent already bought it, as this looks quiet promising.

 

As ever Google provides the solution - Any user can unlock now with this custom GINA That seems to offer you what you need but check the legality of it

[daveyboy]

Maybe its a Netware thing......

Ive created a user and given them local admin rights - Then disabled the login.

On our workstations it will log the user off (back to a login prompt) - but deny login to the network.

 

Like I've said - Maybe its a Netware thing....................

[Chris_Jones]

What about a script using the shutdown command?

 

you could place a batch file on the teachers desktops that asks for the computer name then inserts it into a script like this

 

shutdown /r /f /m \\%COMPUTERNAME% /t 0

 

which would force a logoff and restart of the machine (its not possible to just logoff the machines remotely for some reason)

[alonebfg]

What about using mst software lanview 3 as you can force logoff remotely. I get email i then use lanview to force log user off