Disable Fast User Switching for RDP (NOT HIDE ENTRY POINTS!)

Question

Windows 7 Pro.
I do virtually all my administration of 150 workstations (various domains and workgroups) remotely via RDP, and with Windows 7, I am finding more and more complications with Fast User Switching. Anything running under another user account may well
interfere with what I need to do: it may slow me down by consuming system resources, or it may, in fact, lock files that I need to remove or update.
When I log on remotely via RDP, I am notified that another user is logged on, but I have no option to log the other user off. If I then attempt to update a program that the other user has open, it may not update correctly because the other user has files
in use. I have been told I can use WMI to force another user logoff. I could probably run shutdown -i and force the user off (but, of course, that might log me off as well). However, this is not a good approach; when I run updates, I typically connect to anywhere
from five to 30 workstations simultaneously, and by the time I get logged onto all of them, I have no idea which had other users logged on and which did not. I would have to repeat on each of 30 workstations just to find out. I need a way to force-logoff the
other user during my logon process.
In the middle of running software installation, I may disconnect (NOT LOGOFF) from a workstation, take it to another site, then reconnect to the station to finish the installation. I may even just walk away from my computer for 15 minutes while updates are
running. If a non-administrative user attempts to logon, it asks me for permission, but allows the user to logon if I do not manually deny it. All non-administrators must be automatically denied logon when I am logged on.
It seems that disabling Fast User Switching would do this, but every time I have posted anywhere on the issue, I get another set of instructions on how to hide the entry points for Fast User Switching. That may work well for managing local logons
but fails miserably to protect my administrative environment.

Answer 1

Hi Brian,
Base on the KB article 279765
How To Use the Fast User Switching Feature in Windows XP, when not using Fast User Switching (FUS) and a non-administrator is logged on, a member of the Administrators
group can establish a remote desktop connection and has the ability to logon to the machine locally and gets a prompt to logoff previous logged on user. When an administrator is logged, any member of the Administrators group may establish a remote desktop
connection. If a non-administrator attempts to connect, you may receive the following error message:
“The user <Domain or Computer Name>\<username> is currently logged on to this computer. Only the current user or an administrator can
log on to this computer.”
In Windows 7, if the Fast User Switching is turned off, the Administrator cannot attempt to login locally. Administrator can do a Remote Desktop Session
to the Windows 7 machine and put his credentials. Once he attempts to login, he gets a prompt that looks like below.
“Once Administrator clicks on Yes, the User1’s session is disconnected.”
After logging in, Administrator can launch the Task Manager, click on “Users” tab and logoff User1. The prerequisite for the Administrator
to be able to do a Remote desktop session to the Windows 7 machine is to enable Remote Desktop services on the Windows7 machine.
In the interim, when the Administrator is logged in and has not attempted to logoff User1 yet, if User2 tries to login, the Administrator will get a
prompt that looks like below.
“If the Administrator clicks OK, User2 will be allowed to login and the Administrator’s session will be disconnected.”
This is a known issue.
Regards,
Sabrina
This posting is provided "AS IS" with no warranties or guarantees, and confers no rights. |Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question.
This can be beneficial to other community members reading the thread.