How to logoff after Logon as ..

[Guest]

I logged on as an administrator to a computer using Logon as..

The user is now recieving administrative messages. SO...
How do I log off?

Thanks in advance

[kstanush]

Re: How to logoff after Logon as ..

There are two ways to "disconnect" your session with the computer. If you go to a command prompt, you can type the command:

Net Use

One of the connections listed should be something like \\server\ipc$. To disconnect it, you can simply type the command:

Net use \\server\ipc$ /d

Or, using Hyena, expand the "Local Computer" object in Hyena's left window, and under the Local Connections object, find the IPC$ connection to this computer, right click on it, and disconnect it. You can also right click on the IPC$ connections main entry, and disconnect all of them.

These connections also automatically will normally close themselves after a period of time. If you can't close one, it due to another connection (like a share drive mapping) using it, which can cause it to automatically reconnect.

[Guest]

Re: How to logoff after Logon as ..

Thanks for your reaction but...
It was NOT the solution.

I suppose I was too brief explaining the situation. so here we go again

In hyena, using the right mouse button on a computer(left window), I used the option "Logon as ..." to logon as an administrator.

The option "View Logged On Users..." shows the user logged on AND the local administrator. (This is me, the user I want to logoff)

using: "net use \\server\ipc$ /d" results tne message that the connection does NOT exist.

The user logged on is now recieving messages irrelevant to this user.

(Example: Msg to admin:Virus X on computer Y Cleaned)

SO,

How do I logoff that local administrator???

If anyone can help, please do.

Again thanks in advance

RWJ

[kstanush]

Re: How to logoff after Logon as ..

Hyena's "Logon As" function does not really log you on anywhere, but rather just creates the IPC$ connection between your computer and another, thereby letting you perform operations over that channel. NT/2000 does not support a true "logon", but instead uses the IPC$ connection as a way of authenticating users remotely. I don't think that IPC$ connections should show up under the Logged On users function, because this information is retrieved from the remote machine in such a way that remote sessions and connections should not showup there. Note that service accounts will appear in the list of logged on computers, so make sure that you don't have a service running under the administrator account.

I would also check the Sessions for this computer, just to see if the Administrator account is listed as a connection. This can be tricky to do remotely, as if you are logged on as "administrator" and then check the remote computer's sessions, NT/2000 will have to create a session to the remote computer, so your own account will usually appear as a "session". The only way to verify the sessions is to check is locally using the "net session" command.

Finally, the Net Send command uses NetBios to determine where to send the messages to, and as such, can get confused on what machine/account are associated. If you are using WINS, things can get real complicated on how to resolve a name to a location. You can use nbtstat to list the names that your computer has stored. Unfortunately, I don't understand many of the intricacies of NetBios, so I am unsure if you can remove the errant mapping of the administrator account.

Short of rebooting the remote machine, I don't know of any sure way to "logoff" the administrator account. Please check to make sure that there is not a service account running with this name. Sorry that I can't be of more help.

[Guest]

Re: How to logoff after Logon as ..

No problem,

Thanks anyway.

I'll get back when I find the solution.

RWJ

[Guest]

Re: How to logoff after Logon as ..

<div class="ubbcode-block"><div class="ubbcode-header">Quote:</div><div class="ubbcode-body">Originally posted by TherealRWJ:

In hyena, using the right mouse button on a computer(left window), I used the option "Logon as ..." to logon as an administrator.

How do I logoff that local administrator???
RWJ[/B]</div></div>

How about logging in again with different username using logon as... and selecting this time the "Close any current connection on this server"?

Jari

[Guest]

Re: How to logoff after Logon as ..

OK, a simple Quick & Dirty solution, but the user doesn't get any administrative messages anymore.

still, I have a user logged on...

Thank you for this solution



If anyone knows a way to log off that user I sure like to know ...

[kstanush]

Re: How to logoff after Logon as ..

Can you see if this particular workstation can be rebooted ? After that, check the "Logged On" users to see if the administrator is still logged on. If it is, then its due to a service logging on, and this problem is due to something else entirely. I'd also like to know if another workstation (different from yours) can use the Net Send command to send a message to "administrator" and have it show up at this computer. Somewhere, NT has associated administrator with this computer, and a reboot will tell more information (I think)

[Guest]

Re: How to logoff after Logon as ..

Hello again,

The PC in question is allready been rebooted. The administrator is still logged on.

I dare to doubt that it is a service logging on as an administrator.

This PC has been installed from a Ghost Image like 125 others. Only 2 pc's recieve administative messages.

I DID loggon to those PC's using Hyena's option "Logon As..." finding out the use of this option.


Anyone can use the "Net Send" command. And all administrators will recieve the message Those 2 PC's included.

RWJ

[kstanush]

Re: How to logoff after Logon as ..

OK, I should have asked about the reboot earlier, as this tells me that something a bit wierd is happening here. If you find that when this computer, on a fresh bootup, shows that the administrator account is logged on, then one of only a few things must be certain:

- the administrator account is really logged on (unlikely), as NT only supports one interactive logon session, unless you are using Terminal Server
- you have a service account that is logging on as the administrator. Hyena's service listing will show the "startup" information for all services. Devices should be checked as well for startup information, although I don't think that this is supported.
- some other software, including a VIRUS, could be logging on as the administrator, on each bootup. For example, NT still supports the old RunAs, and autorun features that were part of Windows 3.1 through the registry.
- the mechanism that checks for logged on accounts is somehow broken or being fooled in Hyena. I'll email you with some more information to check on this point

I don't want to overly alarm you, but Hyena's Logon As function merely sets up an IPC$ connection between your computer and the remote machine. The same act can be accomplished by issuing the command:

net use \\server\ipc$ /user:administrator <pwd>

You should check the services and any startup information this computer to ensure that nothing else could be starting up with the administrator account. Also, check the password on the administrator account, and reboot this computer. That too should stop the logon from happening. Do this for both the domain and well as the local administrator account.