Unlock workstation without closing session

For WinNT, Win2000, and WinXP, when a workstation is locked, nobody but the person who locked that station (not even an admin) can unlock the station. When an administator tries to unlock the station, the session will close immediately shutting down all the applications that are currently running on the system. This often poses a problem for us. We often see yellow stickies asking people not to touch the system. Shutting down someones system is simply not an option.

This does not make any sense to me! This, in effect gives a regular user more power than an administrator who should have absolute control over the system.

Ideally, as an administrator, I would like to be able to truely unlock the system. That is, unlock the system without closing the session.

Anyone know how or even if this is possible?

Sue

AFAIK, nope. Another user can't unlock it without logging that user off.

However, you can use a remote desktop tool.

Windows remote desktop will also sign the user off... however... vnc won't!
If you configure it properly, they'll never even know you're watching/looking at the desktop.

Check out vnc @ http://www.realvnc.com/

There are others out there... I just suggested vnc because its free.

If you don't want to do that then... look into remote tools like pstools.

Pretty nice little set of tools.

Quote:

---

PsExec - execute processes remotely
PsFile - shows files opened remotely
PsGetSid - display the SID of a computer or a user
PsKill - kill processes by name or process ID
PsInfo - list information about a system
PsList - list detailed information about processes
PsLoggedOn - see who's logged on locally and via resource sharing (full source is included)
PsLogList - dump event log records
PsPasswd - changes account passwords
PsService - view and control services
PsShutdown - shuts down and optionally reboots a computer
PsSuspend - suspends processes
PsUptime - shows you how long a system has been running since its last reboot (PsUptime's functionality has been incorporated into PsInfo)

---

http://www.sysinternals.com/ntw2k/fr.../pstools.shtml

The windows resource kit also has some good scripts/programs that can help you find out info about a remote system.

http://www.microsoft.com/windowsserv...s/default.mspx
http://www.petri.co.il/download_free_reskit_tools.htm

If you buy the resource kit book, you get many many more tools.

From a security outlook it makes good sense. Imagine if that wasnt the case a system admin who is not happy for whatever reason. Using a Remote desktop style software when his boss is in a meeting he could unlock the bosses computer and start sending e-mails using the bosses account.

In my experiance most remote destop tools wont really help you either if what you want to do is back up the users work before a reboot.
they fonction normally in one of two ways under windows.
Either they connect you to the machine using the session that is active. this means that you can see what the users sees and preform all the standard operations as if you were in front of the machine but if the post is locked locally you have the same problem.
Or else they connect in a console mode like a terminal server. the problem is all the sessions are totaly independant of each other so you cant see what the other people connected have launched.

Edit the_JinX I edited this post to make it read a bit better. If the admin could unlock the sessions of standard users you would get the situation mentioned above.

Quote:

---

Either they connect you to the machine using the session that is active. this means that you can see what the users sees and preform all the standard operations as if you were in front of the machine but if the post is locked locally you have the same problem.

---

Thats the beauty of VNC. :) You can have multiple sessions and still log into the machine even though the desktop may be locked on one session, it won't on another. I'm not sure if this is true with the m$ client... I've only used it on *nix clients.

phishphreek80, How would you go about configuring VNC properly?

I know when i was on work experiance we used VNC to remote control the servers and if the were locked then it would just bring up the unlock dialog box for us and we had to unlock them remotely. So if a user had locked their work station it would be the same as logging on localy like MURACU said.

sue_brighton, Unfortunatly i do not know how to do this but maby some googleing will turn answers up, I know that you can disable the windows lock in at least win2000 so i would have thought it would work across the board. You could prehaps disable the windows lock and then get a third party program to allow users to lock their desktops but ensure you find one with some kind of override, Or failing that make one :)

hellforgedangel: Not quite sure for m$. I've only used it on linux.

It creates multiple x windows desktop sessions.

Let me mess with the windows version a bit today. I might not be able to be done on m$.
Like you all are saying.

I've been wrong before... several times.

<off-topic>

Quote:

---

Originally posted here by MURACU
Using a Remote desktop style software when his boss is in a meeting he could unlock the bosses computer and start sending e-mails using the bosses account.

---

That would be one incompetent admin..
since evryone can send emails from anybody elses acount..

leave me your mail addy and I'll send you a nice worm from [email protected] or would you prefer a pr0n mail from [email protected]
</off-topic>

I'm using VNC at work, and I don't think the windows version can manage multi-sessions (like the linux version does)
Because the host os (windows) is not a real multi-user operating system..

I developed a tool which allows you to unlock the workstation as administrator without logging the user off.

It's currently at the "proof-of-concept" stage and only tested on Windows 2000. The current program simply has a timer, waits for a predetermined interval, then unlocks the local workstation. However I could be persuaded to make a version which works remotely over the network - which is a relatively simple matter.

If you want to persue this further please PM me.

Cheers

Slarty

Oh yes one other thing I should mention...

VNC server works completely differently on Windows than it does on Linux (X). On Linux it creates its own X server which can log on independently. On Windows it simply mirrors the desktop.

If the console desktop is locked, VNC cannot unlock it.

Slarty

the_JinX
I edited my post above so it is clearer.

As for VNC I think that on a windows system you can only connect one session at a time. I know that with windows 2003 server you can use remote desktop to open a number of different sessions on the same server.

Hi Sue,

I am confused :confused:

Quote:

---

This often poses a problem for us. We often see yellow stickies asking people not to touch the system. Shutting down someones system is simply not an option.

---

I haved worked with NT family environments for a good few years and have never found this a problem. You use the word "often" twice?

My experience would suggest a frequency that "I could count on the fingers of one hand in a year"

This suggests that you might have process/practice/procedures problems.

As suggested by the other members, the feature is deliberate. Unless you used a cracking tool, the admin cannot look at a user's password, you can only reset it. This is to make the user wholly responsible for their desktop whilst logged in?

IMHO to try to circumvent this will punch a great hole in your potential to enforce an AUP, as you cannot pin down the use of a workstation to a particular user at any one time?

My questions are:

1. Why do you "often" have to access a users workstation when they are logged in but not present?

2. What are they running that makes them have to often leave sticky notes on their screens?

I think that there might be a work around, but compromising the existing security would only be a very last resort, and require some considerable justification?

Cheers

No idea about 2000 but with xp you can enable fast user switching, this would allow you to log onto the admin account and show running process for all users with the task manager. Without shutting down running progs etc.

Quote:

---

Originally posted here by jinxy
No idea about 2000 but with xp you can enable fast user switching, this would allow you to log onto the admin account and show running process for all users with the task manager. Without shutting down running progs etc.

---

Not while in a domain (IIRC).

Ammo

Thanks for the info about the VNC for windows. I did not know that you could only use one session...

Slarty: I'd be interested in the tool you've developed. You have some very creative projects... what else have you developed?

I am not sure if fast user switching will work if the computer is attached to a domain but if it is just to see what is running then I would go with phishphreek80. Pstools will give you all the information you need as long as you are in the local administrators group.

Edit I hit submit half an hour after writing my reply without actualising the page so didnt see all the updates :D

Hey Guys,

Thanks for all your replies. Wow, I just discovered this board and man does it get results :D

The systems I am working with are installed in a lab where not just I but other people
must have access to. It is company policy to have all systems locked when unattended.
Logging off is not an option because there are monitoring programs usually running.

In any case I think I have found a solution that might work. I must investigate this further.

The Transparent Screen Lock is a third party app (which locks your system either in Transparent mode where you can still see the screen or blanks the screen) can be set to be unlock by the user or an Administrator. When the system is unlocked the user's session is perserved.

Anyone have any experience with this product? Any feedback would be nice.

You can find more info on this product at
http://www.e-motional.com/tscreenlock.htm

Thanks again everyone. I am looking forward to your feedback.

Sue

Thanks Sue,

I had completely forgotten about laboratory monitoring equipment :o

The only "work around" that I have seen is in the defence industry. Here we set up a "generic user" with a password collectively known to the particular project team. That worked because each project "owned" its own equipment, and there was very tight access control.

The software you mentioned sounds interesting, but wasn't around then AFAIK.

Cheers