Forcer la déconnexion immédiate d'un utilisateur authentifié (cas d'urgence)

[ForumBot]

In Active Directory si you want to prevent a user depuis logging in you can soit désactivez leir account ou simply redéfinissez leir password. Cependant, si you have a user who is déjà logged in to a workstation et you need to prevent them depuis accessing tout resources as quickly as possible - how do you do it? I speak of an emergency situation in qui a worker is fired avec immediate effect et there is risk of them wreaking havoc si they are pas locked out of le network immediately.

A peu de days ago J'ai been faced avec a similaire case. At premier J'étais pas sure how to act. Preventing user access to network shares is easy mais this is pas enough. Eventually, I switched le target computer off avec le `Stop-Computer -ComputerName -Force` PowerShell cmdlet et in mon case this solved le issue. Cependant, dans certains cas this might pas be le best choice, say si le user you need to cut off is logged in on plusieurs workstations ou on a computer qui provides an important service et you juste cannot switch it off.

What is le best possible solution to remotely force an immediate user logoff depuis tous workstations? Is this even possible in Active Directory?

[ForumBot]

Best solution: A security guard escort le person out...

Second best solution:

- First, vérifiez le session number avec qwinsta: QWINSTA /server:computername

- Write down le session ID.

- Then use le logoff command: LOGOFF sessionID /server:computername.

>

```
C:\>qwinsta /?
Display information about Remote Desktop Sessions.

QUERY SESSION [sessionname | username | sessionid]
[/SERVER:servername] [/MODE] [/FLOW] [/CONNECT] [/COUNTER] [/VM]

sessionname Identifies the session named sessionname.
username Identifies the session with user username.
sessionid Identifies the session with ID sessionid.
/SERVER:servername The server to be queried (default is current).
/MODE Display current line settings.
/FLOW Display current flow control settings.
/CONNECT Display current connect settings.
/COUNTER Display current Remote Desktop Services counters information.
/VM Display information about sessions within virtual machines.

C:\>logoff /?
Terminates a session.

LOGOFF [sessionname | sessionid] [/SERVER:servername] [/V] [/VM]

sessionname The name of the session.
sessionid The ID of the session.
/SERVER:servername Specifies the Remote Desktop server containing the user
session to log off (default is current).
/V Displays information about the actions performed.
/VM Logs off a session on server or within virtual machine. The unique ID of the session needs to be specified.

```

I wrote a rudimentary batch script for that. I requires certains `unixtools` in le path as well as `psexec`.

```
@ECHO OFF
:: Script to log a user off a remote machine
::
:: Param 1: The machine
:: Param 2: The username

psexec \\%1 qwinsta | grep %2 | sed 's/console//' | awk '{print $2}' > %tmp%\sessionid.txt
set /p sessionid=< %tmp%\sessionid.txt
del /q %tmp%\sessionid.txt
psexec \\%1 logoff %sessionid% /v

```