Logoff local users if they close the rdp session - rdp

I have a new project for my domain and the local users...
My goals:
Switch the local explorer.exe to mstsc.exe, i only want a black screen with the rdp login (i already finished it)
Automaticaly logoff local users, if they closed the rdp session
The challenge:
How can i automatically logoff local users if the explorer.exe & mstsc.exe dont run?

One easy (but dirty) solution I see is a sheduled task running every 1-2 minutes that checkes is both processes are running. In case where explorer.exe is present but mstsc.exe is not - force a reboot or logoff.

Related

Sign out the user if he lost the connection to backend database

I've an Access application located on a server with backend tables.
The application recorded the users sessions; login if they started the app & logout if they closed it.
Sometimes the user lost the connectivity with the server and the application been restarted, the user remains login on the previous session because recording logout from a normal exit not occurred.
Is there a way to check on the backend file if a user is disconnected to record him as "signed out"?
I think your referring to the *.laccdb file that access creates when someone is logged in to the BackEnd table.
Usually if it does list the same PC twice, once all PCs eventually logs out of the BE the *.laccdb should disappear if not, you can delete this file manually however, if the user looses connection ie the VPN goes down and doesnt log back in, then the BE will show that the PC is connected, in this case usually you can delete the *.laccdb.
If at any time you can not delete *.laccdb file Ask the user with the listed PC to log out. Worst Case if a user is not logged in but the *.laccdb exists the listed PC needs to reconnect and disconnect cleanly.
If the FE needs to check for connection to the BE it can be done but will not solve your issue, if the users PC crashed or VPN goes down whilst in the application then there very little that can be done because its too late, the damage is already done.

Logon Script Delay

I'm running a Windows Server 2012 R2, and I've deployed a logon script for my domain, although I've configured the Logon Script Delay to ENABLED ("0" MINUTES), my script still taking the 5 minutes to run after my users log on to their machines!
So what am I missing here to get rid of the 5 minutes delay?
I just researched this. It appears that based on the most pertinent article I read (linked at the end of this answer), you are doing this correctly, based on this statement: "If you enter the time in minutes as zero (0), the setting is disabled, and the Group Policy client runs the logon scripts at user logon without any delay." That is exactly what you did. But your script is still waiting five minutes before executing.
The article does offer another statement presenting another way of achieving your goal: "If you want the logon scripts to run at user logon without any delay, you should configure the setting to Disabled:"
Computer Configuration\Administrative Templates\System\Group Policy:
Configure Logon Script Delay ==> Disabled
Also look into the fact that since this is a computer setting, ensure your computer resides within an OU to which the GPO is linked, that there is no security or WMI filtering at work excluding your computer, and that there is no other over-riding GPO to this policy, and that the GPO is not being blocked. You can run a command to see why the GPO setting may not be applying if this or something else is blocking it:
gpresult /H gporeport.html
Reference: Logon scripts do not run for five minutes after a user logs on to a Windows 8.1-based computer

Run Software as different user

I'm running my exe which removes a piece of software from the machine. My exe is ran as a service account and not my the user user who is logged on. During the uninstall explorer.exe is killed. I would like to call the explore.exe process to run as the current logged on user but I can't work out how to do this.
I have found that you can run it as a different user
Process.Start("C:\Windows\Explorer.exe", username, password, domain)
but I cant find how to do it as the current user and not making the user input their details.

Glassfish: Admin console logs me out before timeout

The glassfish admin console (the web-gui) keeps kicking me out after a quite short amount of time. The default session timeout of 60 minutes wasn't changed. By a short amount of time I'm talking about like 5-10min.
Any idea what might cause this?
I'm connected via localhost without password, but also tried to set a password.
The problem was that I had an application deployed on root-level-context "/" and everytime this app logged out it also killed my admin-gui-session (which was in another tab open in the same browser).

Logoff script to change user

Using Windows 2003, I'm look for a way to create a "logoff script" that will continue with the current logoff then immediately login another user. So, "UserA" logs off. Script fires to login "UserB".
This is part of an application upgrade for a computer where we have written the 'shell'; similar to a kiosk application. For the upgrade we need to logon as 'Adminstrator' then, when the upgrade has completed, logoff 'Administrator' and logon as 'sample_user'. We would like to accomplish this WITHOUT rebooting.
Note, I do not want a script that will initiate the logoff (i.e. "shutdown"). I'm looking for a script that will run upon the user logging off (set via Group Policies). As above, the script should log a different user on.
Thanks.
Don't think it's possible in the stated way (script at logoff).
You'd have to set the machine to logon automatically as a specified account and then log off (having it log on automatically for you) and then you'd have to disable that feature again afterwards, by placing a temporary logon script... generally sounds messy.
The actual setting can be made using tools like Microsofts Shared Computer Toolkit or similar (not so sure how the "normal" registry auto-login behaves at manual logout but I've had an XP kiosk that would automatically log on instantly, even if you logged out manually - you had to override it using some key like shift+logoff to be able to manually specify the login again, so somehow it can be made).
The "easiest" way might be to replace msgina.dll with someone of your own making...
But why are you doing this? Just use runas and start whatever you need to do as that other user without logging off the console user - it's a multi-user system afterall? The desktop is just fluff ^^
(This will anyhow require that the user credentials are available to your script, which kind of makes it redundant as you compromise the security of that account - defying the purpose of having that second account in the first place, for whatever purpose it exists?)
I would try setting the registry to autologon with the user you want, and then simply logging off the admin user. That should log your kiosk-user right back on.
Not sure how to login another user once the current user logs off (not sure if windows would let you...)
But you can use shutdown to logoff:
shutdown /?
Here's some ideas that probaly fall into the "cheap hack" category:
How about logging in at UserB in the first place, and then using runas /user:userA <cmd> to run the first part of the install process?
If that's unacceptable, I know there's a way to make Windows workstations (those that aren't part of a Domain) automatically log in into a certain user account after a restart. Perhaps if you looked into which Registry changes happen, and duplicated them, a reboot would automatically log in that user. (Of course, as a final stage, after userB logs in, you would have to revert those changes :-)
It also occurs to me to wonder if perhaps there's a way for a service to force an open "login screen" to log in as a certain user. Maybe using some method like the way the Remote Desktop does it remotely... If that's possible, then you could create a service that you install before logoff of userA, that would trigger the login of userB.
You can script it with VNC (there are many free versions, take your pick). Set up a VNC server process on the machine to listen on localhost. When the user logs off, your logoff script will connect to the machine using VNC and send the keystrokes necessary to log on the next user. VNC uses the RFB (remote framebuffer) protocol; there are libraries for most popular languages, so you should be able to get something working quickly. Or there are related tools that might help.
If you were to run something like this as a normal script in a given language, it would most likely not work as when you log out of your account, all processes should be killed along with your running script.
You might be able to create some sort of 'service' that would run on a service account (i.e. always active) that would automatically do this user switching for you.
My bets are on Windows Powershell, although I'm not entirely sure what functionality it has as far as actually creating a service.
A quick search brings up the following (The second link is to a forum but it mentions running Powershell as a service and sending that service a parameter which would be the path to your user switching script)
How to Create a Windows Service using Powershel
Powershell Script as a Windows Service
I don't have a Windows 2003 server or a system with a "Group Policies" setup to test my hunch but you could take a look at SU ("switch user") for Windows. Originally part of the Resource Toolkit this has been extended to a new SUperior SU. Do post the results/script if this works.
You could approach this from the perspective of building a remote control utility (like VNC, etc). The big thing here is that if you want access to the Logon screen (i.e. the CTRL + ALT + DEL / username/password) part, the only kicker is that a Windows Service is the only component that can access this, so you'd have to create one.
The only problem I see with this technique as a whole is that even if you spent a great deal of effort getting it to work (and it would be a pretty big effort), the chances of this working successfully with the whole thing originating from a logoff script (i.e. when stuff is shutting down) are low even due to the number of things that can go wrong when logging back on as Administrator.
Just remember that for anything you need to run as an Administrator, there are easier ways in Windows to make that happen (such as Run As, changing the user permissions on the items that need to update, etc).