locked
automatic logout after inactivity/idle RRS feed

  • Question

  • i am trying to setup an automated logout after an idle period for regular domain users. this is a lab environment running windows 7 enterprise x64.

    we used winexit.scr before, but it looks like it is incompatible with windows 7. i have tried making a scheduled task for this purpose but it never executes. i found a program that will do the logoff and i tried to make a scheduled task to execute the program but it never triggers.

    has anyone done this successfully?

    Tuesday, April 6, 2010 10:12 PM

Answers

  • I'm not sure it's working consistently, but here's what I've been able to get to log off the computer at least twice:

    A scheduled task named "Log Off Idle Session", set to run when the user logs on or when the system goes idle, and with Conditions set to run only if idle for 30 minutes.  It's set to run only when user is logged on and [ ] Run with highest privileges is checked.

    Here's the config.  I'll continue to experiment to see if it works consistently.  Perhaps this can help get you closer.

    -Noel

    • Edited by Noel Carboni Tuesday, April 13, 2010 3:43 PM
    • Marked as answer by Arthur Xie Wednesday, April 14, 2010 3:16 AM
    Tuesday, April 13, 2010 2:29 AM
  • A little more research:  Apparently the Task Scheduler only checks for an "Idle" condition every 15 minutes:

    http://msdn.microsoft.com/en-us/library/aa383561(VS.85).aspx

    I've made some changes to the above config and will be trying it out tonight.

    -Noel

    • Marked as answer by Arthur Xie Wednesday, April 14, 2010 3:16 AM
    Tuesday, April 13, 2010 3:02 AM

All replies

  • If I'm not mistaken there's a Group Policy just for doing that...  But what is your motivation?

    Keep in mind you may have users who might like to leave things running and take up where they left off.  I'm sure someone trying to either continue his/her work where they left off the next morning (or even later that night) and avoid the time to set up again would be mighty peeved if you simply ended their session.  The computer may well be inactive, but there can still be a great deal of CONTEXT in what they have left on their screens.  What if, for example, they had entered 100 out of 200 names into a list, and have no way to save until they're done?

    Look for threads on this forum about people upset about being logged off when they disconnect their RDP sessions, for example.

    Isn't locking the screen via requiring a password to exit the screen saver just as secure?

    -Noel

    Wednesday, April 7, 2010 1:26 AM
  • You may try this.

    Shutdown Timer

    Important Note: Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.


    Arthur Xie - MSFT
    Friday, April 9, 2010 9:31 AM
  • READ (above): i am trying to setup an automated logout after an idle period for regular domain users. This is a lab environment running windows 7 enterprise x64.

    Once again Microsoft has no concept of what is needed in an Educational Enterprise environment. First, copy to default profile is disabled and now Winexit is dead. No thought given to how the real users use W7.

     

    Monday, April 12, 2010 10:17 PM
  • My apologies; when I wrote "There is a group policy for doing just that" I believe I was thinking of idle Remote Desktop sessions.

    Saying "This is a lab environment" is a rather thin way of expressing your needs.  Please try to understand that not everyone is standing next to you and implicitly understands what you mean.  If by "this is a lab environment" you mean the computers are shared amongst many individuals who often neglect to log out, it would be much more reasonable to force logouts than if you were setting up people's dedicated desktops to be logged out for some unspecified "security reasons".  Personally, way back when I worked in corporate environments where I wasn't the admin, I always hated it when the admins thought they knew better than I did whether my computer should be logged-out, because I often left stuff running that I wanted preserved.

    Assuming you are willing to take the heat from users who might lose work they've neglected to save, what I might do is explore the Task Scheduler.  For example, you could schedule a SHUTDOWN /L command that will run only when the computer is idle.

    -Noel

    Monday, April 12, 2010 11:38 PM
  • i've tried making a scheduled task with shutdown /l and it has failed to work. i read something about you can't initiate shutdown.exe through task scheduling?

    and yes our background clearly states in plain view inactivity of 30 mins will cause a logoff.

    Tuesday, April 13, 2010 12:51 AM
  • I got it to work this evening, so it is possible. I'll post the details when I get back to the computer.

    -Noel
    Tuesday, April 13, 2010 1:40 AM
  • I'm not sure it's working consistently, but here's what I've been able to get to log off the computer at least twice:

    A scheduled task named "Log Off Idle Session", set to run when the user logs on or when the system goes idle, and with Conditions set to run only if idle for 30 minutes.  It's set to run only when user is logged on and [ ] Run with highest privileges is checked.

    Here's the config.  I'll continue to experiment to see if it works consistently.  Perhaps this can help get you closer.

    -Noel

    • Edited by Noel Carboni Tuesday, April 13, 2010 3:43 PM
    • Marked as answer by Arthur Xie Wednesday, April 14, 2010 3:16 AM
    Tuesday, April 13, 2010 2:29 AM
  • A little more research:  Apparently the Task Scheduler only checks for an "Idle" condition every 15 minutes:

    http://msdn.microsoft.com/en-us/library/aa383561(VS.85).aspx

    I've made some changes to the above config and will be trying it out tonight.

    -Noel

    • Marked as answer by Arthur Xie Wednesday, April 14, 2010 3:16 AM
    Tuesday, April 13, 2010 3:02 AM
  • Okay, I have a configuration that appears to work, logging the user out after 30 minutes of inactivity.

    I've updated the screen grabs above to show it.

    -Noel

    Tuesday, April 13, 2010 12:39 PM
  • Thanks Noel for your contribution on this one. Will this be set for all users? Or will Default have to be copied over?

     

    Thanks!

    Wednesday, April 28, 2010 4:38 PM
  • After copying Noel's exact configuration, it still doesn't seem to work. I even tested with setting it to 1 minute rather than 30. It works if I click "Run" from the manager, but it doesn't run on it's own. Any ideas?

     

    Thanks!

    Wednesday, April 28, 2010 6:58 PM
  • According to the documentation, the Task Scheduler checks for "idle" condition every 15 minutes, so you can't expect it to run reliably at 1 minute.  That was what I found in my testing, and it did make testing quite tricky.

    As far as whether it will be set for all users, it will only be set for whatever user you schedule it for.  As far as getting it to be the default for all users, I'm not completely sure how to go about that.  Most likely, as you say, the Default user profile will have to be adjusted.

    -Noel

    Wednesday, April 28, 2010 7:55 PM
  • I am trying to use this task by deploying it through group policy. I can get it to deploy but I need it to run as any user logged on the system. This could be anyone in the domain. Looking at the event logs, the task tries to run but doe not have the correct permissions. I have tried %USERDOMAIN%\%USERNAME% but that leaves me with MYDOMAIN\COMPUTERNAME$. I need it to run in the user's security context and not the computers context. This may be as simple as deploying it through the User Configuration of the GPO instead of the Computer Configuration.

    What do you guys think?

    Wednesday, August 18, 2010 3:11 AM
  • I was wondering if setting up an idle task would work for something like this. Thanks for the work! I didn't know exactly how often Windows checked on the computer idle time.

    If anyone is interested in a screensaver replacement to winexit.scr, I recommend trying http://www.grimadmin.com/staticpages/index.php/ss-operations .

    Wednesday, September 22, 2010 3:59 AM
  • what do you care what his reasons are? is your advice based on what you think? you spend more time postulating and hypothesizing. just go somewhere else - notwithstanding your sheduled task solution.

     

    we have public access pc's. we want them LOGGED OFF after 30 minutes of inactivity. AND i'm trying to audit a count of logons for management. if user 1 never logs off, and n1, n2,n... users come up, i cant get a count

    as well - you may be aware - the only way to unlock a locked xp pc - is to power cycle.

    we also have shared computers. if a user is too lazy to log off - then the next person has to power cycle - or - so we don't hurt your sensibilities - should we call you at your villa in spain - just so you son't lose - 200 entires without saving - are you nuts - they deserve to lose it just on principle.

    you further the cause of grown adults with advanced degrees, families, mortgages and every other vestige of adulthood - BUT - when they sit down at their computer they're a bag a babbling stupity -

    don't bother flaming - i've got enough to do what we need to do and probably won't be back for awhile - you dope.

    Friday, April 29, 2011 8:32 PM
  • Dearest Noel,

    Who cares what their motivation is and why is that any of your concern? You no doubt think you are being helpful but you should assume when a person asks for help doing something they have probably considered the scenario in further depth than you ever will from one forum post. They did not ask you to debate the repercussions of making this change nor did they come here looking for you to solicit a moral opinion on the subject. The user simply asked for help in accomplishing the desired goal.

    If I had a dime for every self-righteous snide remark made by forum "experts"... If you want to foster a culture of friendly assistance then you and the rest of the people who dive into a help request with an argument rather than helping them need to wise up and just offer the help they are asking for without asking why. If they want your opinion, they will ask for it. If you cannot do that, then perhaps you should turn in your “MCC” at the nearest exit.

    Thank you.

    Wednesday, June 27, 2012 7:54 PM
  • If someone asked how to shut off a car engine whenever the computer detected someone was speeding, would you just assume they thought through every possible scenario?  Would you want to have that car when you're rushing a loved-one to a hospital?  When you're passing a truck?

    Ever worked at a place where the IT department implemented utterly stupid policies that caused you problems in getting your work done?  Gee, IT people couldn't possibly make mistakes like that, could they?  Grow up.

    Bints and dopedope, of the three of us only one has actually made an attempt to help anyone in this thread.

     

    -Noel


    Detailed how-to in my eBooks:  

    Configure The Windows 7 "To Work" Options
    Configure The Windows 8 "To Work" Options

    Thursday, June 28, 2012 12:57 PM
  • For a solution managed centrally through group policy settings take a look at http://wizardsoft.nl/LogoffStandby/logoffstandby.html . Can force logoff or shutdown idle users and also delete temporary user files if you like.
    Friday, June 29, 2012 4:59 PM
  • If someone asked how to shut off a car engine whenever the computer detected someone was speeding, would you just assume they thought through every possible scenario?  Would you want to have that car when you're rushing a loved-one to a hospital?  When you're passing a truck?

    Ever worked at a place where the IT department implemented utterly stupid policies that caused you problems in getting your work done?  Gee, IT people couldn't possibly make mistakes like that, could they?  Grow up.

    Bints and dopedope, of the three of us only one has actually made an attempt to help anyone in this thread.

    -Noel


    Detailed how-to in my eBooks:  

    Configure The Windows 7 "To Work" Options
    Configure The Windows 8 "To Work" Options

    Talk about growing up, seems to me you're using some old playground tactics yourself (of the 3 fo us???.. that's a bit immature).   And I could not agree more with Bint's remarks as it never fails when trying to get help in forums.  It's as if the question is dodged to ponder on some ridiculous moral epiphany tangent.  Grant it you provided possible solutions but had to interject your beliefs at the same time.  Of course that is your right and no one has to read them, but at the sametime you should be willing to accept a little constructive criticism yourself. I don't know why people that posted in a forum 100's, if not 1000's of times feel they are the pontificators of all that is right when it comes to these kind of remarks.

    Noel, just offer some solutions minus the judgement calls.  I think rewording your concerns (judgements)  like "you may want to make sure..."   would be more acceptable than your personal experiences with IT.    And for the record, in a business or institution, those computers do not belong to the individual using them at that time and should adhere to policies set forth to them.  Otherwise suffer the consequences.

    Sunday, July 29, 2012 1:54 PM
  • Thank you for your comments, Rob Roy.  All I ask is that you think about mine next time someone hinders your work and tells you that you need to "adhere to policy or suffer the consequences". 

    Make no mistake, none of what was offered above was criticism intended to be "constructive".

    Oh, and though your advice about presenting my ideas with a bit more humlity is very good (and I will take it), please rest assured I'll be providing my common-sense and beliefs wherever and whenever I choose, thank you.  You're certainly welcome to comment on them as you have done; I welcome your further input.

        

    -Noel


    Detailed how-to in my eBooks:  

    Configure The Windows 7 "To Work" Options
    Configure The Windows 8 "To Work" Options

    • Proposed as answer by Andriy Oliynyk Wednesday, May 13, 2015 1:51 PM
    Sunday, July 29, 2012 7:28 PM
  • Thanks Noel,

    You certainly brought value for me with this answer.

    Haters gonna hate.  SMH

    Craig

    Sunday, October 28, 2012 10:42 PM
  • Hey Noel, thanks for your efforts. I have found that working in a domain environment the scheduled tasks don’t work.

    if I export the task from my PC, import onto another PC, accounts that aren’t admin can’t call the shutdown.exe /l command. and therefore wont queue to start the task.

    if i import it and run a different user with admin rights the task will show up, if no admin rights, no task in the queue.

    The only work around I have come across was with people using the Scriptlogic Desktop authority. Their product has a service that runs in the background continuously that has system privileges, and  that can call the shutdown.exe /l command.  

    Friday, May 10, 2013 4:33 PM
  • There's this GREAT little app now, that does this perfectly. It's easy to install, easy to use.
    Google "Watch 4 Idle".

    - Nicholas
    Monday, July 29, 2013 11:05 AM
  • DLJ, I had a similar issue.  My users are not local admins, but that doesn't cause them to be restricted from running shutdown.exe /l.  Any user can run this command and log themselves off.  The problem was with one of the settings in the task.  Noel's suggestion to check the box requiring the task to run with highest privileges seemed to cause my issue.

    A few tips to get it to work for me through GPO were...

    *  Create the scheduled task in user config in your GPO, not computer config, and apply it to a user OU
    *  Leave the default %LogonDomain%\%LogonUser% for the account so it will run as the logged in user
    *  Uncheck the 'Run with highest privileges' (since the task is running as the user, non-admin users can't do this)

    Desktop Authority (bought by quest and now owned by Dell) is another solution.  We are a reseller of the product and this product does have this capability, but it's not free.

    And thank you Noel, for putting me on the correct path.

    Thursday, September 26, 2013 4:35 PM
  • In order to solve this issue I wrote a small VB.net program that I use to log users out if it has been longer than a specified amount of time without mouse activity or keypresses. It uses the Windows API GETLASTINPUTINFO call, which gives the time of the last keypress or mouse activity (in milliseconds since the last boot time) which is then compared the current uptime to determine the amount of time since the last user activity.

    The threshold for the amount of time in minutes can be changed using the command line. For example, "IdleAutoLogOff.exe 45" would check for 45 minutes of inactivity before logging off users. The default value is 120 minutes.

    Since I didn't want the program running all the time, I used Windows Task Scheduler to run the program every 10 minutes indefinitely. This means that if the threshold is 45 minutes, the computers will log off after 45-55 minutes of inactivity.

    If you have any questions, need any help, or need the actual compiled executable, just ask. Otherwise, here is the task settings and the actual code.

    EDIT: Technet won't let me upload the picture of the task settings for some reason. I'll try to figure it out later.

    Public Class Class1
        Private Structure inputInfo
            Public cbSize As Int32
            Public dwTime As Int32
        End Structure
    
        Private Declare Function GetLastInputInfo Lib "user32.dll" (ByRef plii As inputInfo) As Boolean
    
        Shared Sub Main(ByVal args() As String)
    
            Dim TIMELIMIT As UInt32 = 120 'in minutes
            Try
                If args.GetLength(0) <> 0 Then TIMELIMIT = CUInt(args(0))
            Catch
                System.Environment.Exit(-1)
            End Try
    
            Dim info As inputInfo
            info.cbSize = Len(info)
            GetLastInputInfo(info)
            Dim idleTime As UInt32 = (Environment.TickCount - info.dwTime)
            If idleTime >= TIMELIMIT * 60000 Then Shell("C:\Windows\System32\cmd.exe /c ""shutdown -l""", AppWinStyle.Hide)
    
            System.Environment.Exit(0)
    
        End Sub
    End Class
    

    • Proposed as answer by SterlingMcCall Friday, September 27, 2013 3:56 PM
    Friday, September 27, 2013 3:26 PM
  • No such server as http://wizardsoft.nl/LogoffStandby/logoffstandby.html
    Sunday, December 29, 2013 7:50 PM
  • It redirects to http://wizardsoft.nl/autologoff/autologoff.html , but at $26 per seat it may not be too useful.
    Wednesday, June 18, 2014 7:11 PM
  • I haven't seen this in this thread, but, what's wrong with using screen saver settings, "Control Panel\All Control Panel Items\Personalization" and click on the screen saver in the lower right. At the dialog box adjust the idle time and check to "On resume, display logon screen"?

    Sometimes a simple approach works.


    Thursday, June 26, 2014 7:08 PM
  • Because by using the screen saver method you are not killing any processes left running, hence the Log Off which will do this for you. The screen saver logon screen is not the same as an actual log off/log on, more like a lock screen.
    Wednesday, October 29, 2014 9:36 PM
  • That is great but what if you are using that PC for multiple users.

    IE: One user logs in and keeps on doing their work and at some time they lock the pc and go home or whatever. The next shift comes in and logs with a different user (the first user remaines logged in their session). So this happends with 2 - 5 users in my case. So I have to find a way to LogOff all users that are inactive. Please keep in mind that the computer will not idle since there's another user at the keyboard.

    Any ideeas?

    Thanks.

    Tuesday, August 18, 2015 2:31 PM
  • Current pricing of AutoLogoff is $3.40 for each user with a min amount of 10 users. AutoLogoff does automatic idle user logoff and many more useful related things.

    • Edited by Rinzzz Saturday, January 9, 2016 1:58 AM
    Saturday, January 9, 2016 1:34 AM
  • Long suffered with this problem.
    I tried to do the job according to the description, but it did not work.
    I tried various other options.
    As a result, I write your own application "LockLogout" and use that.

    You can find it on the website platy.ru

    Monday, February 15, 2016 5:55 AM
  • Hi, Sterling McCall. I have copied, and compiled your code, but it doesn't seem to work for me. Is there something special that I must do on the compilation or execution? Can I ask you to send me the complied executable, please? Thanks much.

    Tuesday, June 6, 2017 3:27 PM
  • lithnet.idlelogoff is all you need.

    https://github.com/lithnet/idle-logoff

    Logoff console sessions after idle/idle in disconnected state, contain admx template.


    Monday, June 26, 2017 4:07 PM
  • Great explanation. I would like to do this for 3 users (my kids) but not for my own user.  Will I have to create this scheduled task for each user, or can this be done globally only once, and I can configure for which users to run this?

    Thanks

    Andy

    Thursday, July 13, 2017 5:03 PM