Leaving an Admin Logged in

[jeff.sadowski]

There are a few programs that need to have an admin logged in at all times. Two that I have are one for the office scanner and one for the phone syncs.

I devised a method using TweakUI to automatically log these machines in and I created scripts in startup that check to see if it is being logged in via console and if so lock the screen. Works good but sometimes I have a tendency to forget or have a second admin log in and log off. Not too many log into the console since the room is locked and it takes extra effor on mstsc noted running it from run with the option /console but none the less is there a way to make it harder to log off? like display a warning message? Does anyone else deal with these kind of programs? I guess I could have the same script that locks the screen open a message saying please do not log off of this machine. Does anyone else have any better ideas? Thanks.

[cluberti]

There aren't really any ways to "lock" someone to a logged-on status, but setting a notification message before logon is a good start, and disabling remote connections via RDP is another good one (and use VNC or some other remote desktop solution to access the console). Not really a whole lot else you can do, honestly.

[low_tech]

We have several applications which only run when a user is logged onto the box. We have a custom GPO which extends a RDP connection indefinitely. I would advise this method, then you will not have to worry about the user ever getting logged off. If the user needs to be a local admin, create a application_group in AD, add your user/ID to this group, then add the group to the local administrators group on the server. The only problem you will run into would be having the box restarted or crashing.

Edited March 28, 2007 by low_tech