Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a way to allow either the domain administrator or a specific group to unlock screen savers or locked systems in a Windows domain environment?

Here's our usage scenario. We have a mixture of Windows XP and Windows 7 systems. Some of the users access an IBM iSeries via the terminal emulator. When users leave a session open it blocks our day end processes. To fix that we have to access the users computer either by physically going to it or via LogMeIn and log them out of their "greenscreen". We are able to kill the terminal emulator or kill the sessions from the iSeries. However, that's not ideal as it can leave records in the business system locked.

Currently we're maintaining a list of usernames and passwords (bad idea, I know) so that we're able to login and close sessions when the've been left open and their computers have been locked. I'd like people to lock their systems when they step away and a screen saver would accomplish this nicely. However, I do need to be able to unlock those computers if somebody forgets to log out before leaving. Any suggestions?

Update 1: Unfortunately the enterprise app does not respect logout commands and free up the records. I did some research on grawitys comment. It looks like we might be able to use a custom credential provider on Windows 7. Here is a sample for Vista and Windows 7. We could use a custom GINA for Windows XP.

share|improve this question
1  
Surely there must be a way to close the sessions from the server end? –  Harry Johnston Feb 22 '12 at 23:18
1  
Have you tried using pskill to forcibly close the terminal emulator application on the client machines? –  Harry Johnston Feb 22 '12 at 23:19
1  
I updated the question. We would prefer to not just kill the sessions as it leaves records in the system locked. This is an issue with the application that the vendor doesn't seem interested in working with. –  dkwiebe Feb 23 '12 at 4:32
    
It's possible to force-unlock a Windows XP system given a certain magic command; the login system has been changed too much in Win7 though. –  grawity Feb 23 '12 at 10:57

2 Answers 2

up vote 1 down vote accepted

Have a look at Unlock Administrator. This program lets you assign what user, or group of users is allowed to unlock systems. The users do not need to be admins. You can also set which users can unlock without closing the session and which can unlock but log the user off. The unlocking events can be logged for accountability.

share|improve this answer
    
This program would do what we need for XP. They claim to have a beta version for 7. I'll take a look at it. –  dkwiebe Feb 23 '12 at 18:14
    
I have already been testing the Windows 7 version. It works as advertised but there are a number of features (such as running scripts when locking and unlocking) in the XP version that are missing in this version. –  Tony Fiore Feb 23 '12 at 18:57
    
It looks like the product is out of beta now. –  Tony Fiore May 11 '12 at 15:07
    
Looks good, thanks! –  dkwiebe May 11 '12 at 15:32

Any domain administrator can issue a remote logoff of a windows session using logoff.exe. Hopefully your terminal emulator will see the windows logoff and forward the disconnect so your enterprise app will release the records correctly.

See this page for short tutorial.

logoff <sessionId> /server:<serverName>
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.