🚀 go-pugleaf

Hello all !

I have a Windows Service executing an all Laptops in our company.

The purpose of this service is to connect to the Office (not MS Office
;) main LAN server (another Service running there) whenever the Laptop
is physically connected to our local LAN.
All communications are made over TCP/IP (using Indy).

Now, if the Service that is running (as LocalSystem) on each Laptop
detects that the Laptop has not been connected to the server for 7
days, (configurable from the Service running on the Office Server) the
Laptop shall be "useless" for any user until it has been sucessfully
connected to the Office Server again.
The Laptops only allows users to login with their corresponding domain
accounts, no local users exists on the laptops (except the
Administrator, with a very secret password...)

I need this to ensure that the Laptops are connected to get their
AntiVirus database, Windows Updates and local manuals, applications,
etc updated in a rather tight interval.

Now, how can I make the Laptop "temporarly useless" ?
It may or may not have a user logged in when this situation is
detected.
My idea is that if a user is logged in (the Laptop might be locked and
needs the user or an Administrator to press Ctrl-Alt-Del to unlock it),
my Service could, somehow, log out the currently logged in user by
brute force, but I do not know how to do this since the Service is
running as LocalSystem, not in the context of the logged in User. Is
this even possible ?

Then (and I don't know if this is possible neither), clear all the
cached Domain User passwords (Windows defualt policy is set to save the
last 10 passwords used on that specific Laptop). This will force the
user to connect the Laptop to the LAN to be able to login while
connected to the Office Server (since it is the Active Directory server
as well).

So, in brief, my two main questions :
1: Can a Windows Service force the currently logged in user to logout ?
2: Can I clear the cached Windows Account passwords ?

Or, do I have to create my own Gina.dll for this kind of stuff ?
...or maybe it is just not possible...

Simply, I just need to make the Laptop "unusable" until it has been
connected to the Office Server...

TIA,
/Mathias Thorell
Systems Engineer