Student Account Random Logouts

[VinceM]

Evening All,

 

I am battling a confusing random user logout that is occurring for most students on many different devices (both Windows 10 and Windows 11). It doesn't seem to affect any admin or teacher accounts logged into the same devices. The device logs seem to to suggest the users initiated the logouts but I know from the test devices I have running that it just happens regardless of whether the devices are in use or have been idle for a while. I have gone through a range of ideas from app updates (Minecraft Edu), Classroom control software (Veyon and Sophos for AV) through to various power management settings and things like CEIP. I believe i have isolated it to our Student User GPO, which has evolved for years from well before I started. My thoughts now are to manually recreate the GPO a few settings at a time until I can find out any that seem to cause this. The downside is this will take for ever since there doesn't appear to be any way to force the logout. Some days we can have a couple of logouts in the morning and then nothing for the rest of the day and then you get days like today when it was non-stop all day.

Does any of the collective knowledge here have any suggestions of areas I should concentrate on. My initial thoughts are Google Chrome and MS Edge policies since I have already removed all power management ones which I thought could be the reason. Nothing is immediately obvious in the rest of the policies but this MS afterall so anything is possible. A positive to this though is that I could get a much cleaner GPO. If it helps, the devices are all Intune hybrid joined too, so management is through both GPO and Intune.

 

Thanks

Vince

[Steve21]

You mentioned both GPO and InTune, first thing would be to narrow down which is causing it. If you disable the whole GPO applying to a single test student account does it still occur? At least that would rule out which way to investigate more as if it's still doing it it can't be that GPO either. 

Also would suggest things like disabling Veyon temporarily while testing as if it's something stupid like a student who got access to it would help narrow that one out too
 

If there's nothing sensitive in it could you update a HTML export of the GPO? Might be easier to have a flick through it and see if there's anything that springs to mind as that's so wide open in regards to what could affect it.

Steve

[VinceM]

Thanks for the reply

 

I have narrowed it down to something in our Student User GPO since once I take the student out that GPO they don't get logged out. At present I am recreating the GPO bit by bit until I find something that causes the logouts. Time consuming since the logouts are random unfortunately and don't affect every device at the same time. My current theory is possibly something in the browser configuration settings (Chrome, Edge and IE).

 

I already have Veyon removed from a number of devices (was an easy one if it was the cause but alas it didn't help) and don't have it on my test devices.

 

The HTML export will be a harder one as there is likely some sensitive settings in there unfortunately.

[PotNoodleTech]

If you've got legacy decade or more old GPOs there could be all sorts of bodgery in them from the past reg keys permission things or scripts running etc etc.

 

Start with a clean GPO, add drive maps and some basic permissions eg. control panel etc and then see how it performs.

[VinceM]

Just now, PotNoodleTech said:

If you've got legacy decade or more old GPOs there could be all sorts of bodgery in them from the past reg keys permission things or scripts running etc etc.

 

Start with a clean GPO, add drive maps and some basic permissions eg. control panel etc and then see how it performs.

Thats where I am going now - takes time waiting to see what happens each change though. I've got a basic policy in place but need to tighten it before I can give it to a student to test.

 

I am taking a positive that it will force the GPO to be 'cleaned up'.

[richyboy80]

I have a simialar issue, keen to know what works for you.

 

 

 

[VinceM]

56 minutes ago, richyboy80 said:

I have a simialar issue, keen to know what works for you.

It was something in the group policies. I recreated them all, removing a lot of old legacy stuff. My suspicion is it was a Google Chrome or Microsoft Edge policy but I was under pressure to resolve it so didn't go into too much depth once it was sorted.

Edited September 15, 2025 by VinceM

[Davit2005]

On 24/06/2025 at 07:54, VinceM said:

Thanks for the reply

 

I have narrowed it down to something in our Student User GPO since once I take the student out that GPO they don't get logged out. At present I am recreating the GPO bit by bit until I find something that causes the logouts. Time consuming since the logouts are random unfortunately and don't affect every device at the same time. My current theory is possibly something in the browser configuration settings (Chrome, Edge and IE).

 

I already have Veyon removed from a number of devices (was an easy one if it was the cause but alas it didn't help) and don't have it on my test devices.

 

The HTML export will be a harder one as there is likely some sensitive settings in there unfortunately.

You could obfuscate any sensitive info?