How can I automatically log off admin sessions across multiple Windows servers?

Before automating this, make sure the security policy really requires removing every matching session. A centrally enforced timeout or access-control policy may be easier to support than repeatedly parsing command output. If you do use a script, add logging, exclusions for emergency accounts, a dry-run mode, and safeguards so it cannot log off the account executing the job.

Group Policy has settings for disconnecting or logging off idle sessions, but those settings generally apply to everyone on the machine. They don’t normally let you target only usernames with a particular prefix. That can still be useful as a general safeguard—for example, logging off abandoned sessions after several hours—but it won’t exactly meet the adm_ requirement.

The built-in qwinsta or quser commands can list sessions, and logoff can terminate a session by ID. The output is fixed-width text, so the main work is parsing it into objects, filtering usernames with something like -like 'adm_*', and then running logoff against the matching IDs. A scheduled task can run the script at whatever interval you need.

If the script must be centrally managed, have one scheduled task run from an administrative host. Query the servers in the target OU or from an inventory list, run qwinsta /server:ServerName for each one, parse the returned sessions, and log off only matching accounts. Be careful to skip blank usernames, system sessions, and the account running the cleanup job.