Teramind offers several methods to restrict or prevent user access to a monitored computer. Whether you need to respond to an immediate threat manually or set up automated security responses, you can use the Dashboard, behavior rules, or the Session Player to secure your endpoints.

This method provides immediate, manual control for administrators. Locked employees show Locked in the Status column of the Employees screen. This method also prevents re-entry until an admin manually unlocks the account.

You can manually lock an employee's computer directly from the Employees screen:

1. Navigate to Employees.

2. Select one or more employees by clicking the checkboxes in front of their names.

3. Click Select action above the table and select Lock Access or Unlock Access. The action is applied immediately.

You can also lock or unlock a single employee by clicking the Three Dots icon in front of their name and selecting Lock Access or Unlock Access.

This method enforces the same lock action mentioned in method 1 above, but automates it with a rule. It enables a 24/7 security response to specific threats (e.g., data exfiltration) without requiring an admin to be present. However, be careful, as it might accidentally lock out legitimate users if your rules are not finely tuned.

You can use the Lock out user rule action with any supported rules:

1. Navigate to Configurations > Behavior Policies.

2. Open an existing rule or create a new rule.

3. Go to the Actions step.

4. In the Basic tab, turn on Lock out user. Some actions, such as Warn, Set User's Active Task and Record video, can't be combined with it.

5. (Optional) Enter a message to show the user before they are locked out (for example, You are locked out of the system. Please contact your supervisor.).

6. Click the Submit Rule button to save the rule. When the rule is triggered, the user is taken to the lock screen and automatically logged out again if they attempt to re-enter.

For advanced responses, the Command rule action allows you to execute system-level commands or scripts on the endpoint automatically when a rule is triggered. You can enter a separate command for Windows, macOS and Linux endpoints:

1. Navigate to Configurations > Behavior Policies.

2. Open an existing rule or create a new rule.

3. Go to the Actions step.

4. In the Basic tab, turn on Command.

5. Enter the command in the Windows Command, macOS Command or Linux Command field (for example, taskkill /im spotify.exe /f for Windows). Enter a command for at least one platform, otherwise the action is dropped when you save the rule.

6. Click the Submit Rule button to save the rule.

The commands listed below are merely examples. Enter each command in the field for the matching platform (Windows Command, macOS Command or Linux Command). The command runs on the endpoint as the logged-in user, so commands that require administrator (root) rights may not work, and the command's output isn't shown anywhere. It is recommended that you research and test your specific scripts independently.

Windows:

macOS:

Linux:

Note: On macOS, this turns off the display, which locks the screen only if the Mac requires a password immediately after the display turns off. On Linux, it requires a desktop environment that supports session locking through systemd-logind.

Use Case: Ideal for immediate session suspension when a user triggers a minor policy violation. It forces the computer to the lock screen without closing active programs.

Windows:

macOS:

Linux:

Note: On macOS, apps with unsaved changes may delay the shutdown. On Linux, the command works only if the system allows the logged-in user to power off the computer.

Use Case: Best for critical security breaches where the hardware must be powered down immediately to stop an ongoing attack.

Windows:

macOS:

Linux:

Use Case: For example, if you allow Spotify but want it closed if the user remains idle for 30 minutes, you can use taskkill on Windows, pkill on macOS and Linux to forcefully end the process once the idle threshold is met.

Windows:

macOS:

Note: On macOS, you need to provide the user's current password because the command runs as the logged-in user. On Linux, changing a password without root access requires interactive input, so there's no reliable equivalent. Use the Lock out user action instead.

Use Case: Essential for preventing a compromised user from logging back in after a forced logoff by changing their local credentials.

These options are ideal for real-time incident intervention while watching a user's screen. They allow you to take action without a full lockout.

You can perform these actions from the Session Player's Live View controls. To open the live view, click the Movie Camera icon next to an online employee in the Live Users widget, or select View Live from a computer's Three Dots menu on the Computers screen:

1. Freeze Input: Click the Lock icon to immediately disable the user's keyboard and mouse, preventing further interaction.

2. Remote Control: Click the Cursor icon to take control of the user's desktop and manually secure the system.

3. Send Ctrl+Alt+Del: Click the Exclamation/Warning icon to trigger the Windows Security Options screen, where you can manually lock the account or open Task Manager.

To lock a workstation after inactivity at the OS level, configure your operating system:

Use task scheduling tools to enforce workstation locks at specific times, such as the end of the workday. On Windows, use Task Scheduler; on macOS, launchd or a cron job; on Linux, cron or a systemd timer. A lock command can be as simple as rundll32.exe user32.dll,LockWorkStation (Windows), pmset displaysleepnow (macOS), or loginctl lock-session (Linux).