I'm revisiting a project from about a year ago and want a cleaner way to manage Windows server sessions. I need a process that can inspect active, disconnected, and idle sessions, then log off accounts whose usernames match a prefix such as "adm_". Ideally, this would be an existing Windows feature or supported tool rather than another fragile PowerShell script. The process may need to target a group of servers centrally instead of running a scheduled task on every individual machine, but alternate scripting approaches are welcome.
4 Answers
A Group Policy setting can automatically disconnect or log off idle sessions, and it may be the simplest supported option. The limitation is that it applies broadly to users on the computer; it generally cannot target only usernames beginning with a particular prefix. Some environments set a long timeout, such as eight hours, to prevent abandoned administrator sessions without disrupting normal work.
Windows Server session settings can help if the real goal is simply preventing abandoned administrator logins. However, account-specific timeout policies are not usually available through the standard session GPOs. An Active Directory group and a policy-based approach might work in some environments, but it would need to be tested carefully because password policies and session timeouts are separate controls.
The built-in quser or qwinsta commands can list sessions, including disconnected ones. They return formatted text rather than structured objects, so the output has to be parsed. Once you have the username and session ID, filter for the target prefix and run logoff against that ID. A scheduled PowerShell task can handle this on each server, or a central script can enumerate the servers from Active Directory and run the check remotely.
A PowerShell wrapper around qwinsta is a practical approach. Parse the fixed-width columns into objects containing the username, session ID, and state; skip blank usernames and your own session; then call logoff only when the username matches something like adm_*. Be careful with disconnected sessions and with parsing rows whose session name is missing, since the command output is column-aligned rather than CSV. Add logging and an exclusion list for emergency or break-glass accounts before enabling automatic logoff.
A centralized script is preferable if local scheduled tasks are not acceptable. Build the server list from the appropriate directory container, then query each server with qwinsta or quser and process the returned session IDs.