Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What I'm looking to do is permission a Windows PC (ideally XP but if a later OS version is required so be it) so that a select group of users can unlock the machine, logging the current user out. This something that a Local Admin for the machine would be able to do from a locked screen, however, I'd like to avoid granting Local Admin rights to this group of users if I can.

The background here is that this machine is 80% used by one person but is treated as a 'shared machine' on days that the primary user is not around. It's usefull that everybody using the machine can carry on using their own accounts with all the personalisations that they are used to. I'd also like to avoid logging the primary user out every night. No one else in the firm has to put up with that and she does use the machine herself most of the time.

share|improve this question
up vote 0 down vote accepted

The fact is that this is a well-known problem with no great solution. The basic answer is simply, "No", you cannot do it unless you make them local administrators.

The workarounds include:

  1. They can turn the computer off and restart it, but who wants to wait?
  2. You can make a reboot batch file (shutdown -r -f -t 00) and schedule a task at 2 am to run that nightly, but then your primary user has to log in and reopen everything daily.
  3. You can prevent locking of the workstation using GP: User Configuration>Administrative Templates>System>CTRL-ALT-DEL Options>Remove Lock Computer, and enable that, but that is a security issue.
  4. If you were not on a domain, you could enable "Fast User Switching".

Personally, I would just make them local admins.

share|improve this answer
Damn. I'm going to make them local admins but not tell 'em. – Simon Needham Jun 22 '11 at 15:08
@Simon Needham Obviously the downside is they can install things, which is probably not a big deal, but they could possibly get viruses they might not otherwise have gotten. – KCotreau Jun 22 '11 at 15:12
It is possible to enable fast user switching in 7 (likely Vista but I don't recall) when joined to a domain. – edusysadmin Jun 24 '11 at 1:48
@edusysadmin You cannot enable fast user switching on any OS in a domain. – KCotreau Jun 24 '11 at 1:50
Yes...yes you can. I have it enabled on the domain joined Windows 7 notebook I'm typing on right now. – edusysadmin Jun 24 '11 at 1:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.