When dealing with terminated employees or compromised accounts in Active Directory environments, standard account disablement (via Disable-ADAccount) or password resets don't terminate existing sessions. The user remains logged in until session timeouts occur or they voluntarily log off - creating dangerous windows of vulnerability.

These methods work at different levels of the Windows authentication stack:

# Method 1: Terminate session via WMI (No reboot required)
$user = "DOMAIN\username"
Get-WmiObject -Class Win32_Process -ComputerName TARGETPC | 
Where-Object { $_.GetOwner().User -eq $user } | 
ForEach-Object { $_.Terminate() }

# Method 2: Kill explorer.exe to force reauthentication
Invoke-Command -ComputerName TARGETPC -ScriptBlock {
    Stop-Process -Name explorer -Force
}

For organizations using Azure AD Connect with hybrid environments:

# Revoke all refresh tokens (Office 365 + Hybrid AD)
Connect-MsolService
Get-MsolUser -UserPrincipalName user@domain.com | 
Revoke-MsolUser -UserPrincipalName user@domain.com -All

If your environment uses smartcard/certificate authentication, immediately revoke the user's certificate:

certutil -config "CA_SERVER\CA_NAME" -revoke cert_serial_number

Combine with NAC solutions like 802.1X to quarantine the device:

# Cisco ISE example via REST API
$headers = @{"Authorization" = "Basic "+[Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("admin:password"))}
Invoke-RestMethod -Uri "https://ise-server:9060/ers/config/endpoint/name/$endpointMAC" -Method Delete -Headers $headers

Always verify session termination:

Get-RDUserSession -ConnectionBroker broker.domain.com | 
Where-Object {$_.UserName -eq "domain\user"} | 
Format-Table -Property HostServer, SessionState

In enterprise environments, there are situations where immediate user session termination becomes a security imperative. When dealing with terminated employees, security incidents, or compromised accounts, administrators need reliable methods to instantly revoke access across all endpoints.

While Active Directory provides account management tools like disabling accounts or resetting passwords, these methods don't address active sessions:

• Disabled accounts remain logged in until session expiration
• Password resets only affect future authentication attempts
• Group Policy changes have delayed application

1. PowerShell Forced Logoff

The most precise method targets specific user sessions across multiple machines:

# Query active sessions on target computer
$sessions = quser /server:TARGETPC
# Parse session ID for the target user
$sessionID = ($sessions -match 'username')[0].Split()[2]
# Force logoff
logoff $sessionID /server:TARGETPC

2. Mass Termination Script

For environments with multiple active sessions:

# For all computers in OU
$computers = Get-ADComputer -Filter * -SearchBase "OU=Workstations,DC=domain,DC=com"
foreach ($pc in $computers) {
    $sessions = quser /server:$pc.Name 2>$null
    if ($sessions -match 'malicioususer') {
        $id = ($sessions -match 'malicioususer')[0].Split()[2]
        logoff $id /server:$pc.Name
        Write-Output "Terminated session on $($pc.Name)"
    }
}

3. Emergency Group Policy Update

Combine with logoff scripts for defense-in-depth:

# Create immediate action GPO
New-GPO -Name "EMERGENCY_LOGOFF"
Set-GPPermission -Name "EMERGENCY_LOGOFF" -TargetName "DOMAIN\malicioususer" -TargetType User -PermissionLevel GpoApply
Set-GPRegistryValue -Name "EMERGENCY_LOGOFF" -Key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -ValueName "ForceLogoffWhenHourExpire" -Value 1 -Type DWord

Network-Level Isolation

For immediate effect while working on session termination:

# Block at firewall level
New-NetFirewallRule -DisplayName "Block_Terminated_User" -Direction Inbound -Action Block -RemoteAddress (Get-ADUser -Identity malicioususer -Properties IPPhone).IPPhone

Session Server Solutions

For Remote Desktop Services environments:

# Query all RDS sessions
Get-RDUserSession -ConnectionBroker "rdcb.domain.com" | Where-Object {$_.UserName -eq "DOMAIN\malicioususer"} | ForEach-Object {
    Invoke-RDUserLogoff -HostServer $_.HostServer -UnifiedSessionID $_.UnifiedSessionId -Force
}

Create reusable PowerShell modules for emergency response:

function Emergency-UserTermination {
    param(
        [Parameter(Mandatory=$true)]$Username,
        [switch]$NetworkIsolation,
        [switch]$PreserveData
    )
    
    # Session termination logic
    # Network isolation procedures
    # Evidence preservation routines
}

Document and test these procedures during security drills to ensure reliability during actual incidents.