[hulala.[uk]]

hi all,

we are having a little issue with people leaving computers locked in computer labs and no one can obviously use them unless they restart the machine or call us to unlock it for them which sometimes is very frustrating coz we've got better things to do then going around labs unlocking machines.

so basically we have production coordinators that suppose to manage computer bookings etc so we want to delegate this task to them, but we cant seems to figure out how to do it coz they are not in the administrative group. We dont really want to make them admins just for that, does anyone know if there is another solution to this?

we use NT domain with no AD (ldap authetication).

any ideas are welcome

cheers

[Noise]

There's a screensaver you can setup that logs off the current user instead of being a screensaver. I think it's called logoff.scr

That would be perfect for you. Just setup a group policy (gpedit.msc) that forces the use of this screensaver and BAM - when the screensaver activates - the user is logged off.

[hulala.[uk]]

ic what you saying and yes it would be perfect but i forgot to mention that we have another type of users, they need to leave machine rendering their work, like 3dmax or maya or inventor/cad, premiere or afterFX so those usually leave note on the machine so we dont log them off. students will eat us alive if we do the logoff.scr;)

[D3H6G9]

Don't know much about XP but dont' you just force the specific groups to use the scr for logoff? aka seperate in different group

[SecretNinja]

cant you make a gpo that stops peole from locking there computers, and then make a group that will exempt the max users from this policy. there for only specific people can lock the computer.

[hulala.[uk]]

thnx for all of your suggestions,

@D3H6G9: all users must have rights to render (e.g. leave machines locked for valid reasons) as an equal opportunity.

@SecretNinja: we have this GPO in place already its when they leave machines after 10min screensaver kicks in and then machine lockes itself after that.

i think what i need is to find out how i can make particular users being able to log off other domain users without being local admins, or may be they think they are but somehow take all other rights and persmissions away from them to do anything else on the machine. is that possible?

[hulala.[uk]]

alright...i think we will have to go with plan B make shared account add it to Administrative group and then explicitly deny logon locally for that particular account through GPO.

:\