Terminated employees still logged on

[edavid3001]

When we disable an employee, they may still be logged onto their local
PC via the domain account. Disabling the account doesn't force them to
log out of their PC.

Right now we do a psloggedon -l username to see where they are logged
on, then reboot that PC.

Is there a way to use GPO's to force a disabled user to be locally
logged off?

 

[Peter Demeyer]

"computer configuration - windows settings - security settings - local
policies - security options - network security: force logoff when logon
hours expire" is the closest thing I found. Maybe this will work too.

 

[edavid3001]

My users have 24 hour access, and some of them work 24 hours (not a
day, but have wierd shifts.)

For that to work I'd have to have some period of time when their login
is disable such as Midnight to 00:15, and I'd have to configure that
setting on the local policy of the machine via GPO, right?

I've thought about doing that, but the fact that most of my users can
be working any day/time around the clock makes it difficult.