Restricting Fast User Switching

Question

Restricting Fast User Switching

Hi All
I would like to restrict who can use the fast user switching feature. Basically I work in a company that has freelancers coming in and out and who seem to be incapable of logging the computer out. Instead they use the Fast User Switching menu just to return to the login window which causes issues for the next person who logs in.

I would like to keep the Fast User Switching menu usable for admins (even just local admin would do) but not allow general users. I could turn off Fast User Switching entirely but I also like having the full name of the user logged in in the menu bar.

Has anyone done anything similar or got any ideas? I've looked at /Library/Preferences/GlobalPreferences.plist but it seems to be just an on/off without any shades of grey.

Thanks for any assistance

Mac OS X (10.6.7)

Posted on Apr 12, 2011 5:06 PM

Reply

Answer 1

TeenTitan

Level 4

2,640 points

Apr 12, 2011 6:55 PM in response to AussieAppleUser

Hi AussieAppleUser,

Have you considered forcing passwords for temp accounts? That way even if they do lock the screen; you can still can log them out?

Reply

Answer 2

Linc Davis

Level 10

209,739 points

Apr 12, 2011 8:22 PM in response to AussieAppleUser

There's no way to restrict fast user switching by user. You'll have to find another solution.

What issues are caused when the freelancers fail to log out?

Reply

Answer 3

May 17, 2011 4:50 PM in response to AussieAppleUser

Just to tidy this up

TeenTitan: All accounts have passwords but IT doesn't(shouldn't!) know these passwords. The issue is not locked screens but people who use the fast User Switching menu to return to the login window, leaving themselves logged in and allowing others to log in over the top.

Linc: Issues are the Adobe suite (specifically CS4) complains the licence is invalid if multiple users try to open one of the applications. Yes we can kill the process via ssh or ARD but it just generates helpdesk calls which we don't want 🙂 Another app also throws up errors whenever more than one user is logged in.

For what its worth I have a sort of solution.

I disabled Fast User Switching on all machines and wrote an Apple script app so my IT team can still use the functionality of FUS if needed. I would still like to have login name in the menu bar but I have not found a solution to that yet.

F.U.S Apple Script:

do shell script "/System/Library/CoreServices/Menu\\ Extras/User.menu/Contents/Resources/CGSession -suspend" with administrator privileges

Reply

Answer 4

TeenTitan

Level 4

2,640 points

May 18, 2011 6:36 PM in response to AussieAppleUser

Well if you have an Open Directory you could try this... It might have issues. It worked for me but I only tested it for a few minutes.

put all the computers into an OD computer group. Add /Library/Preferences/.GlobalPrefrences.plist to the MCX of the OD computer group. Under always of the MCX for .GlobalPrefrences.plist add MultipleSessionEnabled as boolen value is FALSE.

Then, in an OD user group, put all the OD Users you want MultipleSessionsEnabled into the OD Group. Then for the group add /Library/Preferences/.GlobalPrefrences.plist to the MCX. Under always add MultipleSessionsEnabled as boolean value is TRUE.

This way, when a user logs MultipleSessionsEnabled is set to on or off accordingly. I don't know if it would cause any side effects, but it worked with me. If you do have an OD; and you need more detailed instructions I'd be happy to post step by step instructions.

this also means the menu extra for fast user switching loads for user who have the setting enabled; but not for user who have it disabled. I tried loading the menu extra directly; but it seems that it hide/quit it self if fast user switching is disabled.

Reply

Answer 5

Jun 1, 2011 5:26 PM in response to AussieAppleUser

I recently discovered GeekTool that will display all sorts of info (login name!)as an overlay to the desktop. Problem solved 🙂

Reply

Answer 6

Barney-15E

Level 10

123,014 points

Jun 1, 2011 5:51 PM in response to AussieAppleUser

You can effectively use FAS without enabling FAS if you use this command to background the current user:

/System/Library/CoreServices/Menu\ Extras/User.menu/Contents/Resources/CGSession -suspend

You can wrap it up in a shell script or an Automator workflow. It suspends the user and switches to the login screen.

You'd just have to keep it buried somewhere that your admins could get to from any user login and run it.

Reply