How do I set WIN/XP to log off automatically?

Where I work someone in administration decided that moving our email service from yahoo to outlook would be a really good idea (now I can get the virus of the week -- joy). Why I do not know but they hired someone to come in and set up outlook on every computer.

After the work was done, I innocently asked how we would keep the user accounts apart. For background we have a multi-user environment but nobody pays any attention to it. It is routine for me to be logged onto a few computers for days at a time.

Well, now that the hired guy is gone, the obvious answer was to put me in the admin group and ask me to run around the building setting up each machine so that they log off after a few minutes. The problem I am having is that I have never done any XP admin work. I browsed the control panel of one machine for a few minutes yesterday but I did not see anything obviously intended to do what I am being asked to do.

Waht I need to do is basically set up a timer similar to a screensaver but instead of loading cool graphics I need to force each machine to log out.

I'm not sure if the blank screensaver, set to display the welcome screen on resume, fits your needs...

of course that does not log off the present user, but if you forced a log off, couldn't that cause some loss of unsaved work?

I am not sure if Windows XP can force a log off...

but I've found a little utility which might do what you want to do, called ShutDown Plus, for $5. It seems to be able to force a log off after some inactivity: http://www.dimaware.com/shutdown/shutdown.gif

I found it on this page: http://www.dimaware.com/shutdown/shutdown.html

edit:

looks like turd may have found exactly what you were looking for!

Blank SS set to require password - requires a password to be entered before getting back into windows - so either the same user would have to re-enter his password to get back on the machine, or someone else could enter their password to get back on.

Am I correct in thinking you mean an off-line logoff, and not a shutdown?

Could this be what you want?

http://support.microsoft.com/default.aspx?scid=kb;en-us;314999


You can get winexit.scr and the rest of the resource kit here:

http://www.microsoft.com/downloads/...69-57ff-4ae7-96ee-b18c4790cffd&DisplayLang=en

That screen saver could just do the trick. One thing I also need in order to make it work: How as an administrator do I impose it on other user accounts?

Instal the files on each box set up the configuration you want.

then
go to the run box
type gpedit.msc

goto
user configuration\administrative templates\control panal\display

then confgure the "hide screen saver tab" and "hide settings"

This will keep the users from changing this once you set it. The way to impose it is to reguire logins to all computers. Then each time a user logs off/forced off=inactive they or another user will log in/ will log back in for each use.

You also want to look at your account policies under windows settings/security settings in the gpedit snapin. Sounds like you need to tighten there also.

forget to add, make sure you set up a test box for a day or so, rember this is windows.

Ok I played with that tonight but I still need some information. How do I force everyone else to use that screensaver?

Looking at the policy editor, I could not help but notice that nothing is set up. we seem to have no policies at all. So that wraps it up for our current security standard. Any other suggestion that would get us up to date would also be a huge help...

Well thats pretty typical that you could have nothing set up and that everyone just logs on and leaves the box running all day and shared. It seems that was what was working for you?

But from what I understand you just want to change this behavior to keep each new Outlook account specific to each user. So you have to change this behavior of not logging off when done. Well each user has a profile and that screen saver will be part of each profile they will be forced to use it by having it on the computer. (And you tweek out their ability to change it.)Just set it up on each computer as admin and have it used for each user. Im not sure if there is anything else you have to do. What I would do is set up a test box, put a couple users on it, some outlook, instal the program as admin, log in as user and see what u get. I would not go active with this stuff until you have it all figured out and configured. You are forcing some behavior that is going to go against peoples present use. Couple that with the new outlook change and some are probably going to be initially un happy. You dont want to have some mis-configured or buggy setups, or suprises right in your face. I would also just go with what you are tasked with and not start creeping into other stuff until you get this fleshed out. But this is just my humbley submitted opinion. Suroot or some of those other guys know much more about this stuff then I and you might want to PM them.

Is this a domain? If so, then do this in the default domain-wide group policy. Open up AD Users & Computers. Right click on your domain, properties. Group Policy Tab. Select the default policy (which, unless someone's played with something, should still be applied everywhere). Edit. (continue below)

If it's not on a domain, then you'll just need to edit it on each individual PC.

Start/run/gpedit.msc

(continue...)

Browse to User Configuration / Administrative Templates / Control Panel / Display
"Hide Screensaver Tab" = Enabled
"Activate Screensaver" = Enabled
"Screensaver Executable Name" = full path to the exe. (hint: either copy it to all the computers if possible, or put it on a network share if it's too many computers).
"Screen Saver Timeout" = number of seconds until screensaver run.

Save and exit.

Reboot all the computers (or wait a while.. 15 minutes, I think), and the policies should be adopted by everyone.

im praying hes talking about a domain and he can set a group policy.
if not, im seriously praying theres not many comps to set this up on XD, the process could take a while.

when i first saw this, i was reminded of a class i took in installing and implementing win 2k pro and server, but i didnt remember ne thing about forcing a log off. save for windows logging off a logged on user if they were logged on past their alotted log on hours.

i_am_tux said:

im praying hes talking about a domain and he can set a group policy.
if not, im seriously praying theres not many comps to set this up on XD, the process could take a while.

Click to expand...

You don't have to pray too hard. I can get into the group policy editor and even if that is not enough there are only 15 computers that I have to deal with.

A bit of background might help you guys understand where I am coming from.

As the “tech guy” it has been my job to keep the computers running for a few years (I have my share of horror stories). The company is publicly funded and we have to spend our money by the end of the fiscal year. Also we cannot give money back the the various agencies (well we are supposed to but...) because if they are left holding money at the end of the year it reflects badly on them and they will face the budget axe next time around. So 2 ½ years ago I was given $15,000 to spend on whatever I felt that I needed and only three weeks to spend it.

Now my computer illiterate administration asked me to spend some of the money on a file server and two DSL lines (to be connected to two individual computers – they are that clueless). Don't ask how they were going to get anything in/out of the file server locked in a closet and not networked. So among other things I ordered a router, a switch and a spool of CAT-5 (and only one DSL line). When I asked our building manager for some assistance pulling lines the administration guy freaked out. Apparently, they were already in secret negotiations with some company to network the building and I was upsetting their carefully laid plans.*

So the network was set up by some guy they hired on a low ball bid and I really have no clue what they did. Now 2 ½ years later, they have pulled another nightmare move and they gave me the admin privilege so that I can do this incredibly easy task for them.

I told the guy who gave me this task about the screen saver today and he gave me a blank stare. He says that there is a setting in XP that I can get to if I just look for it. He thinks that it is in the control panel but he does not have the time to tell me what he is thinking about (I wonder if he is thinking at all but that is a different story).

So I guess that I have two questions.

First, does anyone know what he is talking about? Is there a setting somewhere in XP that does this or is he just proving how clueless he is one more time?

Second, In that I can get into the group policy editor, am I about to give everyone a rude surprise when I change the screen saver across the whole building?

First, does anyone know what he is talking about? Is there a setting somewhere in XP that does this or is he just proving how clueless he is one more time?

Click to expand...

I think he was referring to the ability to have the computer prompt you for a password when you come out of the screen saver.

Second, In that I can get into the group policy editor, am I about to give everyone a rude surprise when I change the screen saver across the whole building?

Click to expand...

Hmmm... well it will change their screensavers to the one you set it as, and it will log them off just like its supposed to... so it might be a good idea to warn them of this before you do it.

i_am_tux said:

I think he was referring to the ability to have the computer prompt you for a password when you come out of the screen saver.

Click to expand...

Obviously I am no XP genius. AFAIK most if not all screen savers can be set to ask for a password. But that is set by each user and that can be used to lock out anyone who does not know the password set by the screen saver. We have had people use the “lock this computer” setting to DOS access to specific computers. I do not want to prevent access to certain boxes. I want to make sure that people need to use the legitimate password that is set by an administrator.

Hmmm... well it will change their screensavers to the one you set it as, and it will log them off just like its supposed to... so it might be a good idea to warn them of this before you do it.

Click to expand...

Well, the guy who is having me do this announced that he is working on a new “security policy” for our computers a couple of weeks ago. Since he really does not know what he is doing (and has left our computers wide open up to now), I am thinking that this might be my opening to make some real policies that actually serve some useful purpose.

So now I need to head in another direction before I am sure if I have the answer to the question that I started this thread with.

I know that we have NAV running on our server but that is AFAIK the only protection that we have. I would love to hear some ideas for what else we can do. If someone knows of a pop-up blocker that I can run from the server that would be nice. Also something along the line of Adaware and/or Spybot-search-and-destroy would be a huge help...

What he is talking about is the prompt for password when you come out of standby. You can set the standby and the time to go into. You just need to again tweak the policy so that the users cant change what you have set up.




rclick desktop\properties\screensaver



standby settings are on the screensaver\ power tab

setting to require a pass prompt are on the screensaver\power\advanced tab

Sometimes you can find standby may be conficting, so check it out prior to rollout

Create a new OU in the domain, and move your personal computer into it. create a new policy there, and add the screensaver parts to it. Test as much as you like, only your computer will be affected.

Then, once you have everything the way you like it, drop another computer in (of someone beside you or something), and test that it works on more than your machine.

Then email everyone, and tell them if they leave the computers logged on anymore, they will self-logout. wait for the flak to hit, if it isn't too bad, set that policy on the entire domain.