Allow non-administrator accounts to unlock a pc

[Guest richard]

The trick that the little angels have come up with is to lock a pc instead of logging out. I have now been told to find away to allow staff to unlock the pc with either turning it off or getting me or my tech to do it. I know that you can allow certain tasks to be done by non administrator accounts but can this?

[Quackers]

We had this problem, so i just disabled the Lock Workstation option for pupils.

[Guest richard]

We had it disabled but I have had orders to reinstate it.

[apeo]

Not sure if there is a specific permission you can issue but local Administrator rights will allow them to unlock workstation. I wouldnt suggest giving them Administrator rights tho.

 

As a thought maybe what you could do is to turn on Remote Desktop and use this to log them off. This atleast stops you from having to walk down there.

 

Another thought would be to Reprimand the kid that did it.

[Guest richard]

We have Viglens Classlink installed here to remote access is already there and we are using it on a day to day basis to help with support.

[apeo]

Not used Classlink before so Im not sure what its capable of but if i was in your shoes i would lay down strict rules about this kind of behaviour, which should sort out most of the problems. Then on odd occations when you have the need to unlock the workstation, just do it remotely.

[ChrisH]

Hmm we just get them to tap the power button and the machine shuts down normally....

[flyinghaggis]

I don't think it can be done without granting Admin rights (to the local PC at least) and I'm guessing your probably (quite rightly) not going to want to do that!

Perhaps you could add a new group policy that only applies to pupils that would stop them from locking workstations but wouldnt affect staff if they're moaning about losing the option?

[Guest richard]

I don't think it can be done without granting Admin rights (to the local PC at least) and I'm guessing your probably (quite rightly) not going to want to do that!

Perhaps you could add a new group policy that only applies to pupils that would stop them from locking workstations but wouldnt affect staff if they're moaning about losing the option?

 

They wanted the students to be able to lock workstations as well as staff.

[flyinghaggis]

Ah, not sure it can be done then. I think as someone else mentioned that pressing the poweroff button on the PC case itself should shut down the PC even if someone is logged on/locked. This is probably the best thing to do but it does mean that you have to shut down the PC to do it. At least it's better than pulling the power plug as it shuts down the PC cleanly.

I dont think there would be anyway to give them access (other than admin rights) as logging someone off a machine would require permissions to close any of their open files and close all their active processes. You wouldn't have these rights unless you were a local admin on the PC. I can't think of any easy way to selectively grant those kind of permissions either.

 

:?

[tosca925]

GPO

 

User configuration>Admin Templates> System? C-ALT-DEL options> remove lock computer

 

 

Is this any good?

 

 

Students to lock workstations.........? Never

[uk101man]

You can logoff a locked workstation remotely!!

 

http://gethelp.devx.com/techtips/nt_pro/10_minute_solutions/10minNT0102/10minNT0102-3.asp

[webman]

I think the Logoff option on my RPKiller script will kick them off as long as you run it with admin rights.

[Guest richard]

GPO

 

User configuration>Admin Templates> System? C-ALT-DEL options> remove lock computer

 

 

Is this any good?

 

 

Students to lock workstations.........? Never

 

Like I said earlier that option was already in place but I was instructed reinstate it.

[apeo]

You can logoff a locked workstation remotely!!

 

gethelp.devx.com/techt...0102-3.asp

 

I assume you would require admin rights to run win32shutdown?

[Face-Man]

why not setup a new ou with a GPO stoping the students from locking the computers. Then when user name "a" leaves the computer locked move them into that OU so they can't do it again. This way your responsible students (I think If met one or two) still have the abbility and thouse that abuse it don't. If the teachers complain ask them to come up with a better solution :twisted:

[MouseAT]

What happens if you create a local administrator account specifially for unlocking user accounts, and set it to deny logon locally? Would it still allow it to be used for unlocking the computer?

 

Failing that, you need to be explaining to management that only administrators can unlock computers, and that if it's a problem, their complaints should be directed at Microsoft. Then ask for a decision - either you disipline students who abuse the 'lock computer' feature, and have admins unlock computers, or you disable the 'lock computer' altogether.

[Shiny_Guru]

You can lock out an administrator but the account can take the rights back again - it has built in permissions in the ACLs that overide all sorts of restrictions, so non priv. account uses run as citing the 'special' admin account to grant prvalidges and away you go.

 

Sadly we het the problem, although we have the students set up to be not able to lock workstations in their GPO settings, the lock button on Logitech keyboards (and probably others) overides the setting Doh!

 

The kids in our school hit reset so often to 'log out' that we are normally only asked to unlock machines in the room next to us so the problem is self limiting in our environment (until next years roll out when I am going to have all the reset buttons disconnected :-) )

 

There is a custom GINA floating around the web that has been modified to to remove the lock functionality all together but that has always seemed a bit to much like open heart surgery for my liking - it may suit your needs though.