active session windows detect and kill

[evilkalah]

Is there a possibility to run a vbs script each minute wat looks at the active sessions and kill them if its a specifick user? Does anyone of you know how to detect a active session ( by share ipc$ )

 

[tsuji]

Hello evilkalah,

You can enum sessions on the domain control and if you discover a user then you retrieve the computer logged into. From this info you can log it out. (But unless you disable the account, the user can log back in.)

sdom="a0b1c2"
username="jsmith"

shost=""
bFound=false
set fsvc=getobject("WinNT://" & sdom & "/lanmanserver")
for each osession in fsvc.sessions
    if strcomp(osession.user,username,1)=0 then
        shost=osession.computer
        bFound=true
        exit for
    end if
next
set fsvc=nothing

nDone=false
on error resume next
if bFound then
    set svc=getobject("winmgmts:{(Shutdown)}:\\" & shost & "\root\cimv2")
    set chost=svc.execquery("select * from win32_operatingsystem where primary=true")
    for each ohost in chost
        iret=ohost.shutdown(4)
        if iret=0 then bDone=true
    next
end if
set chost=nothing : set svc=nothing
on error goto 0

msg=""
if bFound then
    if bDone then
        msg="User " & username & " has been found logged on." & vbcrlf & "Force logoff is done successfully."
    else
        msg="User " & username & " has been found logged on." & vbcrlf & "Force logoff failed."
    end if
else
    msg="User " & username & " has not been found logged on."
end if
wscript.echo msg
wscript.quit

regards - tsuji