Auto log off disconnected sessions

From all my research this doesn't look possible, but I thought I would ask anyway.

Environment:

- Windows domain environment - 2 2008 R2 AD servers, 1 2003 AD server, 2003 functional level for now
- Mostly XP machines, new medical tablets and all-in-one pcs will have windows 7 32-bit

Is there a way to auto log off disconnected client user sessions in windows 7? I know there is a way to log off disconnected sessions in terminal services using an idle timer, but from everything I've read you can't do this on a client. I found Grim's screen saver log off solution here and it works if no one uses the fast user switching ability. My problem is that the medical tablets probably will not sit long enough for the auto log off to kick in. A user will come by pick up a machine that the last user didn't log off (and never will, even if I tell them they will lose their jobs if they don't!) and do a switch user function, leaving a disconnected session. This will probably happen multiple times, leaving many disconnected sessions and a slow device. I would disable fast user switching, but our single sign on software must have fast user switching enabled in order to function properly. So much so that it overrides group policy and registry edits.

So I was hoping to find an easy solution. All I need is for some kind of timer to be set on the disconnected sessions. Once the timer is up the disconnected session is forced to log off. Works this way on TS, not sure why you can't do this on a client.

Disable Switch-User?

tchafey said:

Disable Switch-User?

fail

I would disable fast user switching, but our single sign on software must have fast user switching enabled in order to function properly. So much so that it overrides group policy and registry edits.

EarlThePearl said:

tchafey said:

Disable Switch-User?

fail

I would disable fast user switching, but our single sign on software must have fast user switching enabled in order to function properly. So much so that it overrides group policy and registry edits.

Disable access to the button, not the service?

tchafey said:

EarlThePearl said:

tchafey said:

Disable Switch-User?

fail

I would disable fast user switching, but our single sign on software must have fast user switching enabled in order to function properly. So much so that it overrides group policy and registry edits.

Disable access to the button, not the service?

Let me try and explain this further.

There are 2 ways that I know of to disable user switching in Windows 7, found on this site for reference:

How To Enable/Disable Fast User Switching In Windows 7, Vista, XP

1. Group Policy - you can disable this way, either local or from the AD server, but my SSO software will pretty much ignore and override it.

2. Registy Edit - you can make the new entry to hide and disable user switching, but the SSO software will delete this edit 1st chance it gets.

So the end result is user switching WILL be enabled if the SSO software is installed...period. (I don't agree with it either but it is what it is) If there is some way to block SSO from overriding it or stop it from deleting the registry key the SSO software will just stop working.

This is what I'm getting when I try to run the script. Anyone actually get this to work?

Thanks,
Isaac

>for /F "tokens=1-7 delims=,: " %a in ('query user | find /i "disc"') do if %d GTR 32 (logoff %b ) else %e GTR 32 (logoff %b)

>if 3 GTR 32 (logoff 5 ) else 5/6/2011 GTR 32 (logoff 5)
'5' is not recognized as an internal or external command,
operable program or batch file.

>choice /T 120 /C 1 /D 1 /N

I have the script (.cmd) file running in an elevated command box.

How do you go about running it as a service?