Allow Non-Admin users to logoff other users?

[awayman]

We have run into several situations where I would like one person (UserA) to be able to log off a user (UserB) who has locked windows (or the screensaver locked windows), but I don't want to give UserA administrative access to the machine.

We haven't found anything in group policy in Win2k at the workstation or domain level that would allow us to do this. Is it possible?

TIA.

 

[bcastner]

I do not believe so. Tell user B the username and password of user A, or give them Administrative rights.

 

[Shady66]

Sounds scary giving users Admin rights....

you could be asking for trouble

Lead, Follow of get the %&*#%$ out of the way !!

 

[tsuji]

Hello awayman,

I would consider setting up an well-deliminted organizational unit. Put userA and B etc and the workstations into it. With the ou, you delegate the rights to user A to administer the ou, users and computers... Something along this line.

regards - tsuji

 

[Davetoo]

Shady66 - You don't give them domain admin rights, you give them local admin rights.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[awayman]

Thanks for the suggestions, but I don't want to give them full admin rights (even local admin, and definitely not domain admin) on these boxes.

Part of this issue involves shared computers at remote sites. We sometimes have two or more staff people that need to use the same PC, but none of the users on-site can be trusted with admin rights to the box.

The only two solutions I've thought of so far are:
1) Create an admin account that we can tell people on the phone to use just to log off the other user, then have them log in as themselves. I don't like this, because it's still giving an admin login to non-admin users, and eventually, people would start just logging in with those credentials.

2) We can force logoff based on time, but these people aren't on any kind of regular schedule, so that's out.

I'm guessing this is one of those things that would be really nice to have, but Microsoft will never give us the ability to do. Any other ideas would be apppreciated.

 

[bcastner]

1. Consider using WinExit screensaver from the reskit:

http://www.win2000mag.com/Articles/Index.cfm?ArticleID=4541

2. Consider doing the logoff remotely:

http://www.sysinternals.com/ntw2k/freeware/psshutdown.shtml