Member Avatar for lenni

Hi

I need to force a logoff for idle users through a gpo, after 2 or 3 hours of inactivity.

The suggested solution in every previous thread is using a screensaver that does the trick.

That's not good for me, because I need the screen saver to run after 15 minutes of inactivity and lock the computer. I need to force the end of a session after a much greater period of time.

Lock after 15 minutes (I already use the screensaver).
Logoff after 3 hours.

I'm using W2003svr and workstations have xp.

Thanks in advance!!
Lenni

  • 3 Contributors
  • 3 Replies
  • 658 Views
  • 2 Months Discussion Span
  • Latest Post Latest Post by Windo

Dani AI

Generated

Quick summary and where the earlier suggestions fit: was on the right track for network sessions — NET CONFIG SERVER /AUTODISCONNECT only controls how long SMB/mapped-drive sessions stay connected, it does not log a locally‑interactive user off. (learn.microsoft.com)
If users are connecting via Terminal Services / Remote Desktop, Group Policy can enforce idle time limits and end (log off) sessions after X time; that is the simplest built‑in fix for RDP sessions. (windows-security.org)

For local, interactive XP desktops there is no single GPO that will automatically log off a console session after N hours (the “Interactive logon: Machine inactivity limit” setting only triggers the lock/screensaver — it does not perform a logoff). To meet your requirement (lock at 15 minutes, then force logoff after ~3 hours) the usual, reliable approach is per‑user code that runs inside the user session and calls the Win32 idle API; when the script sees the configured idle threshold it issues a logoff. The Win32 API used for this, GetLastInputInfo, returns the last input for the session that called it, so the helper must run in each user session (logon script / scheduled task "run only when user is logged on"). (learn.microsoft.com)

Practical, low‑risk deployment plan (works on XP/2003 with PowerShell available or by compiling a tiny helper): install a small per‑user background script that checks idle seconds and calls the logoff command when idle >= 3 hours. Example PowerShell skeleton (run at user logon; change $IdleLimitMinutes to 180):

Add-Type @"
using System;
using System.Runtime.InteropServices;
public static class Idle {
  [StructLayout(LayoutKind.Sequential)]
  public struct LASTINPUTINFO { public uint cbSize; public uint dwTime; }
  [DllImport("user32.dll")] static extern bool GetLastInputInfo(ref LASTINPUTINFO plii);
  public static uint GetIdleSeconds() {
    LASTINPUTINFO lii = new LASTINPUTINFO(); lii.cbSize = (uint)System.Runtime.InteropServices.Marshal.SizeOf(typeof(LASTINPUTINFO));
    GetLastInputInfo(ref lii);
    return ((uint)Environment.TickCount - lii.dwTime)/1000;
  }
}
"@

$IdleLimitSeconds = 180 * 60
while ($true) {
  if ([Idle]::GetIdleSeconds() -ge $IdleLimitSeconds) { Start-Process -FilePath "logoff.exe"; break }
  Start-Sleep -Seconds 60
}

Notes and troubleshooting: run this as a logon script or scheduled task with the trigger “At logon” and option “Run only when user is logged on” so GetLastInputInfo measures that session. If PowerShell isn’t available on your XP images, use a tiny compiled helper (AutoIt/AutoHotkey/C#) that does the same call and invokes logoff — or use a vetted third‑party idle‑logoff tool if you prefer (those wrap the same API). Also test on a lab machine first (unsaved work will be lost when you force logoff). For PowerShell examples and community samples that use Add‑Type/GetLastInputInfo as shown above, see community threads showing this technique. (stackoverflow.com)

This approach gives you both: immediate lock at 15 minutes via your screensaver policy, and an enforced session end after the longer idle window without relying on SMB autodisconnect or RDS settings (unless your users are RDP users — then use the Terminal Services GPO). (windows-security.org)

Member Avatar for arun_cdm

Go to a DOS shell (cmd) and type NET CONFIG SERVER. Towards the bottom it should say something like "Idle Session Time: 15" - This means it'll log someone off after 15 minutes of inactivity, though I've never seen it in action. Use NET CONFIG SERVER /AUTODISCONNECT:x to specify a time in minutes for the allowed time of inactivity.

Member Avatar for lenni

Hi, thanks for your reply.
I've been searching online and it seems to me that NET CONFIG SERVER is used to disconnect mapped drives, or a connection to a shared folder or printer in general, i.e. the connections that you can see in NET USE. It doesn't seem to close the applications and finish the windows session for the user, which is what I'm looking for. I've tried it though, but it didn't work.
Thanks anyway. Any other help will be greatly appreciated.
Lenni.

Member Avatar for Windo

Try the easy tool from It will do logoff after a period of inactivity and/or enters standby mode. Usefull for shared computer/laptop scenarios in schools for example.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.