Automatically deny non-admin local or remote user logon while administrator is logged on remotely via RDP

Question

I manage all computers and servers for about five small businesses and do 99% of my support from my home office via RDP. To avoid interrupting users' work, I do a large amount of my update and installation work at night, on weekends, or early in the morning when the users are off the system.

I often log onto anywhere from two to upwards of 50 computers for the same or different clients simultaneously to work on software/OS updates or troubleshoot problems. Since I can have only one remote session in the foreground at any one time, I often have many that are open in windows behind my active RDP or program window.

A perennial problem is that the end user will come along locally or via RDP of their own and attempt to log on or attempt to do so from home via RDP. On that user's end, it asks whether he wants to preempt my admin logon, but I never see it because I have another window in front of that RDP session window. So the first indication I have that someone has requested preemption is a message indicating that I have been disconnected because someone else has logged on over me. And that is a big problem if I was in the middle of installing a critical application or update in which the user absolutely cannot use it until I am complete. To make matters worse, this will be one window of perhaps 20, and I cannot easily tell which one it was, or it may happen to more than one at nearly the same time. So all I know is that I have lost connection to some computer I was working on but not which one.

This is a very long-running problem; if I recall it is a "feature" that arrived with the arrival of Windows 7. After all these years, I still need a way to simply notify any local or remote non-admin user that another user is logged on and give no option to preempt, at least if the initial user is an administrator and the preempting user is not, while still allowing administrator to prompt to requestt preemption of non-admin users. In my environment, there is no reason on any of the ~200 computers I manage to allow any non-admin user to even request preemption; all non-admin users should simply be told someone else is logged on.

Has this situation improved at all in the last ~10 years with perhaps some secpol or registry setting? It remains as absolutely odious now as it was the moment it was foisted upon me with the advent of Windows 7.

Answer 1

1. The initial popup does not tell the user that the administrator is signed in, in which case I could at least have a policy requiring that they ask me, only that another user is signed in. So they cannot tell that it is administrator until after they have irretrievably requested preemption. Besides that, I have no idea which of the ~50 users in the company might try to log on over me, and I cannot just notify the entire company every time I touch one computer. That would be every night.
2. There are obvious reasons why scripts will not work well. Not only are they complex to deploy, but that assumes incorrectly that the administrator will be able to log on and off perfectly 100% of the time. An unexpected reboot during my remote session would result in me no longer being logged on but no other user being able to log on locally--even if the user were to do a hard shutdown/restart via the power button.

But that is all beside the point, since my question was not about workarounds, and those are both workarounds; it was whether there has been any effort given to providing a way to re-enable the lost option of disallowing users to preempt administrators. I was just hoping that someone at Microsoft had the common sense to see that there might be good reason to have an option to deny users access to a computer while an administrator is logged on.

You are apparently saying that they do not. While there is nothing new about that lack of understanding of the real world by developers, at least now I know there is no effective solution.

Thank you.

Answer 2

Hi,

When a user locally or remotely log on to the PC where another user has already logged on, it will tell the user "Another user is signed in. If you continue, they'll be disconnected". So, why not inform the users of your working time and ask them not to sign in the PC when they see this information.

If you would not like to do that, what I can think is to write scripts which run when your administrator account logon and logoff. When you log on to the PC, the script runs to add other users to the "Deny log on locally" and "Deny log on through Remote Desktop Services" lists. And when you log off, the script runs to remove those users from the lists.

Script writing is not supported currently in Q&A forum. But you can raise your requirement to the PowerShell Script forum for consultant.
https://learn.microsoft.com/en-us/answers/topics/windows-server-powershell.html

Thanks,
Eleven

----------

If the Answer is helpful, please click "Accept Answer" and upvote it. Thanks.