How to kick a user off the network

I need to know how to kick a user off the network, I know
I can disconnect a user through Active Directory, but that
doesn't get a immediate reaction. I am running a Windows
2003 server platform with mainly XP clients. I had a user
who brought a virus into the network through his computer,
when I told him to shut down, he didn't do it immediately.

We're no longer in the world of "dumb terminals". You can't kick them off
the network in the sense you think because they aren't "on" the network in
the sense you think. Being "on" an Windows network is not a constant
"on-going" thing like is was with a "dumb terminal". You could walk up to
his machine and yank the network cable out and he isn't going to notice the
difference until he tries to access a network located recourse or service.

There is also the difference between being on the network in the Layer 1,2,
&3 sense vs being on the network according to Windows Networking and AD
which is above and beyond the OSI Layers altogether.

As far as the virus,...if you had time to find out he had the virus, then it
is already too late anyway and doesn't matter what anybody does. If the
virus was going to do something it would have already been "history" long
before you or anyone ever noticed that it was there.

The proper defense for all this would be to have proper AV protection on
your network so that the virus couldn't do anything anyway.

--

Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com


"Karl" <(E-Mail Removed)> wrote in message
news:1b4ec01c44fc6$adc90d90$(E-Mail Removed)...
> I need to know how to kick a user off the network, I know
> I can disconnect a user through Active Directory, but that
> doesn't get a immediate reaction. I am running a Windows
> 2003 server platform with mainly XP clients. I had a user
> who brought a virus into the network through his computer,
> when I told him to shut down, he didn't do it immediately.

If its a virus problem you are dealing with, go to the switch and disable the port his plugged into. That is what we used to do at a former job when clients got a virus called Nachi and it worked well.

I had the same problem. I always have a gpo that forces all PC to be remotly administered. With xp just remotly login then perform a shutdown command.

Hi Karl

If you know the computer name or IP address of the machine(s) the user is
logged in on, you can use pskill (part of PSTools from www.sysinternals.com)
to remotely kill the winlogon.exe process.

This will cause the machine to reboot.

Regards

Oli



"Karl" <(E-Mail Removed)> wrote in message
news:1b4ec01c44fc6$adc90d90$(E-Mail Removed)...
>I need to know how to kick a user off the network, I know
> I can disconnect a user through Active Directory, but that
> doesn't get a immediate reaction. I am running a Windows
> 2003 server platform with mainly XP clients. I had a user
> who brought a virus into the network through his computer,
> when I told him to shut down, he didn't do it immediately.

However, if the machine's infected, you'll want to shut down rather than
reboot, so use psshutdown from the same place.

Regards

Oli


"Oli Restorick [MVP]" <(E-Mail Removed)> wrote in message
news:e$(E-Mail Removed)...
> Hi Karl
>
> If you know the computer name or IP address of the machine(s) the user is
> logged in on, you can use pskill (part of PSTools from
> www.sysinternals.com) to remotely kill the winlogon.exe process.
>
> This will cause the machine to reboot.
>
> Regards
>
> Oli
>
>
>
> "Karl" <(E-Mail Removed)> wrote in message
> news:1b4ec01c44fc6$adc90d90$(E-Mail Removed)...
>>I need to know how to kick a user off the network, I know
>> I can disconnect a user through Active Directory, but that
>> doesn't get a immediate reaction. I am running a Windows
>> 2003 server platform with mainly XP clients. I had a user
>> who brought a virus into the network through his computer,
>> when I told him to shut down, he didn't do it immediately.
>
>

re: your response:

The proper defense for all this would be to have proper AV
protection on
>your network so that the virus couldn't do anything
anyway.
>
>--
>
>Phillip Windell [MCP, MVP, CCNA]
>www.wandtv.com

I don't understand why some people feel the need to
clutter up these forums with their sanctimonious put-
downs. Every one of us has made mistakes; we come here
for helpful suggestions, not to be made to feel
belittled. If you have nothing helpful to offer, keep
your editorials to yourself.

>-----Original Message-----
>We're no longer in the world of "dumb terminals". You
can't kick them off
>the network in the sense you think because they
aren't "on" the network in
>the sense you think. Being "on" an Windows network is
not a constant
>"on-going" thing like is was with a "dumb terminal". You
could walk up to
>his machine and yank the network cable out and he isn't
going to notice the
>difference until he tries to access a network located
recourse or service.
>
>There is also the difference between being on the network
in the Layer 1,2,
>&3 sense vs being on the network according to Windows
Networking and AD
>which is above and beyond the OSI Layers altogether.
>
>As far as the virus,...if you had time to find out he had
the virus, then it
>is already too late anyway and doesn't matter what
anybody does. If the
>virus was going to do something it would have already
been "history" long
>before you or anyone ever noticed that it was there.
>
>The proper defense for all this would be to have proper
AV protection on
>your network so that the virus couldn't do anything
anyway.
>
>--
>
>Phillip Windell [MCP, MVP, CCNA]
>www.wandtv.com
>
>
>"Karl" <(E-Mail Removed)> wrote in
message
>news:1b4ec01c44fc6$adc90d90$(E-Mail Removed)...
>> I need to know how to kick a user off the network, I
know
>> I can disconnect a user through Active Directory, but
that
>> doesn't get a immediate reaction. I am running a Windows
>> 2003 server platform with mainly XP clients. I had a
user
>> who brought a virus into the network through his
computer,
>> when I told him to shut down, he didn't do it
immediately.
>
>
>.
>

Please don't read emotions into a message when those emotions were never
there.

Correct concepts help to produce correct solutions. I'm only trying to help
correct an error in what "being on" a Windows based network means so that it
leads to a correct response to the problem. The correct and best solution is
to have a system fully protected from viruses using one the popular AV
solutions. This prevents the virus from infecting anything,..which then
allows you the time required to deal properly with an infected machine that
was brought into the system.

--

Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

<(E-Mail Removed)> wrote in message
news:1c68401c452e5$527c9020$(E-Mail Removed)...
> re: your response:
>
> The proper defense for all this would be to have proper AV
> protection on
> >your network so that the virus couldn't do anything
> anyway.
> >
> >--
> >
> >Phillip Windell [MCP, MVP, CCNA]
> >www.wandtv.com
>
> I don't understand why some people feel the need to
> clutter up these forums with their sanctimonious put-
> downs. Every one of us has made mistakes; we come here
> for helpful suggestions, not to be made to feel
> belittled. If you have nothing helpful to offer, keep
> your editorials to yourself.
>
> >-----Original Message-----
> >We're no longer in the world of "dumb terminals". You
> can't kick them off
> >the network in the sense you think because they
> aren't "on" the network in
> >the sense you think. Being "on" an Windows network is
> not a constant
> >"on-going" thing like is was with a "dumb terminal". You
> could walk up to
> >his machine and yank the network cable out and he isn't
> going to notice the
> >difference until he tries to access a network located
> recourse or service.
> >
> >There is also the difference between being on the network
> in the Layer 1,2,
> >&3 sense vs being on the network according to Windows
> Networking and AD
> >which is above and beyond the OSI Layers altogether.
> >
> >As far as the virus,...if you had time to find out he had
> the virus, then it
> >is already too late anyway and doesn't matter what
> anybody does. If the
> >virus was going to do something it would have already
> been "history" long
> >before you or anyone ever noticed that it was there.
> >
> >The proper defense for all this would be to have proper
> AV protection on
> >your network so that the virus couldn't do anything
> anyway.
> >
> >--
> >
> >Phillip Windell [MCP, MVP, CCNA]
> >www.wandtv.com
> >
> >
> >"Karl" <(E-Mail Removed)> wrote in
> message
> >news:1b4ec01c44fc6$adc90d90$(E-Mail Removed)...
> >> I need to know how to kick a user off the network, I
> know
> >> I can disconnect a user through Active Directory, but
> that
> >> doesn't get a immediate reaction. I am running a Windows
> >> 2003 server platform with mainly XP clients. I had a
> user
> >> who brought a virus into the network through his
> computer,
> >> when I told him to shut down, he didn't do it
> immediately.
> >
> >
> >.
> >

<(E-Mail Removed)> wrote in message
news:1c68401c452e5$527c9020$(E-Mail Removed)...
: re: your response:
:
: The proper defense for all this would be to have proper AV
: protection on
: >your network so that the virus couldn't do anything
: anyway.
: >
: >--
: >
: >Phillip Windell [MCP, MVP, CCNA]
: >www.wandtv.com
:
: I don't understand why some people feel the need to
: clutter up these forums with their sanctimonious put-
: downs. Every one of us has made mistakes; we come here
: for helpful suggestions, not to be made to feel
: belittled. If you have nothing helpful to offer, keep
: your editorials to yourself.

He didn't offer something helpful. He informed the OP he should be
PROACTIVE rather than REACTIVE. I don't know why there are people like you
that think blowing smoke up someone's ass is productive.

You don't try to administratively down an infected computer. You build your
network with layers of security and keep it updated. On the rare chance you
do get infected, you take control of the situation. You don't ASK the user
to do anything. You remove the user from the situation and deal with it.
If they won't get off the network, remove their patch cable and take it with
you, better yet, take their system. The fact is, if you have to get to this
point, you have no control of your network which is the point being made.
The user's do NOT control the network and it's NOT their computer.

The OP has no control of the network, in more ways that one. That doesn't
imply the OP is the problem. That is an unknown and it's irrelevant. It
could be, as it usually is, lack of organization, due to lack of knowledge,
due to lack of funding, due to lack of knowledge, due to having a moron with
Chief behind their name who doesn't know how to build or manage a department
and thinking their ideas don't stink when they're not qualified to manage
their way out of a wet paper bag. Politically correct means lying. It's
plain BS and a complete waste of time, as is your response. He doesn't know
if the OP is incapable or incompetent or just being controlled by those
without a clue. He's not passing judgment on him. If you can't handle the
truth, join the Liberal party. If you want a truthful answer, quit yer
whinin' and you might just learn something but I doubt it since you already
missed the first response.

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Online Support for IT Professionals -
http://support.microsoft.com/service...p?fr=0&sd=tech
How-to: Windows 2000 DNS:
http://support.microsoft.com/default...b;EN-US;308201
FAQ W2K/2K3 DNS:
http://support.microsoft.com/default...b;EN-US;291382

Usually what I do is the "shutdown -i" from the run command.....I shutdown
the clients comp & send him a message...


"Oli Restorick [MVP]" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> However, if the machine's infected, you'll want to shut down rather than
> reboot, so use psshutdown from the same place.
>
> Regards
>
> Oli
>
>
> "Oli Restorick [MVP]" <(E-Mail Removed)> wrote in message
> news:e$(E-Mail Removed)...
> > Hi Karl
> >
> > If you know the computer name or IP address of the machine(s) the user
is
> > logged in on, you can use pskill (part of PSTools from
> > www.sysinternals.com) to remotely kill the winlogon.exe process.
> >
> > This will cause the machine to reboot.
> >
> > Regards
> >
> > Oli
> >
> >
> >
> > "Karl" <(E-Mail Removed)> wrote in message
> > news:1b4ec01c44fc6$adc90d90$(E-Mail Removed)...
> >>I need to know how to kick a user off the network, I know
> >> I can disconnect a user through Active Directory, but that
> >> doesn't get a immediate reaction. I am running a Windows
> >> 2003 server platform with mainly XP clients. I had a user
> >> who brought a virus into the network through his computer,
> >> when I told him to shut down, he didn't do it immediately.
> >
> >
>
>