Giving user / group ability to logoff user

[Chris]

I'm looking for a way give a specific user or group the
ability to logoff a user on a server. I've set the
policy to allow shutdown of a machine in our servers OU,
then gave administrators, domain admins, and our
operations acct. that ability. This works great as long
as these select users can log in to the server. If an
admin has locked the server console however, then the
operators (whom have no admin privilages)are stuck.

I'd prefer not giving our operations account admin rights
on the servers. Better I'd rather tweak the reg. or
something such that they have the ability to force logoff
of whomever locked the console in the first place.

Thanks

 

[Steven L Umbach]

Tell the administrators to logoff and not lock the computer. If this is
happeneing automatically , use the Winexit.scr screensaver from the Resource
Kit that has the ability to log off a user after a period of inactivity
instead of locking. Locking a computer can also be disabled in Group Policy,
but of course a user with domain administrator rights could reverse that
change. A reboot will also allow a user to logon - not the best solution but
can be done if needed. --- Steve