Discussion Locked

User Security

0 helpful
15 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
How can I ensure that after an account is disabled in either NT4 or 2000, that the user has been disconnected from all network resources, and dicconnected from the workstation login?

15 replies

by tamj123

I think following steps only work on win 2000

To accomplish the subject task:
1. Right-click My Computer and press Manage.

2. On the Action menu, press Connect to another computer.

3. Double-click the computer you wish to connect to or type the computer name in to the Name box and press OK.

4. Right-click Computer Management () and press Properties.

5. On the Advanced tab, press the Startup and Recovery button.

6. On the Startup and Recovery dialog, press the Shut Down button.

7. Select between:

Log off Current User
Shut down
Restart
Power down (if supported)

and press OK.

for WIN NT you can use "shutdown" command, type c:\shutdown /? at dos Pompt for more info.

by jgordon500

This is what I had planned for the workstation side of the problem, but I still need to ensure that the user is disconnected from all network resources. If they are logged into a machine that I don't know about, then I wouldn't know to log them off.If there were a way to find all resources in use by "USER", then I could simply send a shutdown to all of those workstations, but I may be disrupting another user. Thanks for the response.

by nels

Server Manager:

Depending on the "network resource", you can disconnect the user by looking at the machines that the resources are housed. Then disconnect the user if an open session exists for that user.
Go to SrvMgr.
Select the machine a/the resource is on.
Go to the users button.
Search for the target account.
Disconnect the account if it is listed.

by jgordon500

This would require logging into too many server to be effective. I need a way to find out what the user is attached to and disconnect them.
Thanks for the response.

by nels

Server Manager:

Depending on the "network resource", you can disconnect the user by looking at the machines that the resources are housed. Then disconnect the user if an open session exists for that user.
Go to SrvMgr.
Select the machine a/the resource is on.
Go to the users button.
Search for the target account.
Disconnect the account if it is listed.

by shmaltz

Open up server manager on the server you want to see if that user is connected to it.
Click on sessions/users and select the user and click Dissconnect.
To open Server Manager: In WINNT 4.0/2000 goto start run srvmgr click ok. In windows 2000 only: Right click on my computer click manage > System Tools > Shared Folders > Sessions.

by jgordon500

This is what I was trying to avoid. In our environment there are too many server that a user could be attached to that this process becomes unwieldy. Thanks anyway

by rkelly

You could simply specify logon hours to the users you disable - ensure that they cannot logon at anytime of the day and make sure that the servers are specified to forcibly disconnect anyone whose hours have expired.

Obvously there will be a slight lag before the user is logged off, but that lag will probably be shorter that checking every open connection to every available server, just to check whether that user is currently connected.

by jgordon500

Tried this, and it doesn't work. I disallowed all login hours, but after several hours the user was still attached to all resources and able to access. Thanks for responding.

by jgordon500

Let me clarify. User gets fired. At the moment they have been informed of this their account is disabled. We want to make sure that ALL resources are secured from the user AT THAT POINT IN TIME. Need to essentially force the user off the system in as efficient a manner as possible.

by shmaltz

I gave the following answer:
Open up server manager on the server you want to see if that user is connected to it.
Click on sessions/users and select the user and click Dissconnect.
To open Server Manager: In WINNT 4.0/2000 goto start run srvmgr click ok. In windows 2000 only: Right click on my computer click manage > System Tools > Shared Folders > Sessions.

You replied:

From JGordon500@aol.com on 12/27/01 10:54 AM EST: This is what I was trying to avoid. In our environment thereare too many server that a user could be attached to that this process becomes unwieldy. Thanks anyway
To do this on more than one server at once you can use a windows2000 machine and create your own MMC console that includes all server.
To do that:
1. Strat > Run, type in mmc and press enter.
2. click on Console > Add remove snapin
3. click add
4. Add either the Computer Management snap in or the shared folders snap in. Shared folders is the one you realy need to get the job done. However you can do much more with Computer Management.
5. Click on another computer and select your computer (if you chose the shared folders snapin you have an option of just viewing the open files or all 3).
6. Repeat step 3-5 for all servers.
7. Click on options to change it to user mode.
8. Click on save and save it wherever you want.
Now you have one interface to check all the servers.

by jgordon500

While this will work for W2k, I also need to ensure that user is disconnected from all NT4 servers as well. Thanks tho.

This discussion is closed to new replies.