Skip to main content
Updated October 15, 2026 The Users section of the Guardian tab lists the Windows accounts on the server, who is signed in and which accounts are locked out. From there you can sign a user out, unlock an account or set a new password, without connecting to the server. Raff Guardian never does these on its own: each one runs only when you press its button. They work in every mode, Watch only included.

​
Before you start

  • Raff Guardian on the server. See Install on an existing server.
  • To see the list: vm.view. To sign out or unlock: vm.manage. To set a new password: vm.manage and permission to open the console (vm.console), signed in to the dashboard (not an API key).

​
See who is on the server

Open the server under Virtual Machines, click Guardian, then Users. The How to connect card shows the server’s address and a Download Remote Desktop file button. The Windows users card lists the accounts that are turned on in Windows, locked accounts first, then signed-in ones. Each account shows:
  • Its tags: Administrator, built-in, domain account.
  • Its sessions, for example “Signed in over Remote Desktop since 09:15, idle for 20 minutes, from 203.0.113.7.” A user counts as idle after 15 minutes without input.
  • When it is not signed in: its last desktop sign-in in the last 90 days.
  • “Locked out after too many wrong passwords” when Windows locked it.
Click Show details for when each password was set, the last sign-in of any kind (also SSH and file shares), services or scheduled tasks that run as the account, accounts turned off in Windows, and the server’s sign-in rules. Click Check now for a fresh list.

​
Sign a user out

  1. On the account, click Sign out (End session for a disconnected session; with two sessions, Sign out of the console or Sign out of the Remote Desktop session).
  2. The dialog warns that programs the user has open close without saving. Click Sign out, or Not now.
The result appears under the account, for example “Raff Guardian signed admin2 out of the Remote Desktop session.” If auto sign-in is on for the account, Windows signs it in again at the next restart.

​
Unlock an account

  1. On a locked account, click Unlock.
  2. The dialog says the account can sign in again at once, and after how many wrong passwords Windows locks it again. Click Unlock.
With automatic blocking on, bots guessing passwords are blocked by address instead of locking your accounts, so you should rarely need this.

​
Set a new password

1

Press New password

On the account, click New password. Read the dialog: the old password stops working at once (for a domain account, once the domain controllers have the change), and anyone signed in stays signed in.
For a local account, passwords the user saved in Windows (for example for Remote Desktop or in a browser) and files they encrypted with Windows cannot be opened any more. Services or scheduled tasks that run as the account fail at their next start until you give them the new password.
2

Confirm

Click Set a new password. If the server’s console is protected with two-factor authentication, enter the 6-digit code from your authenticator app. One code is enough for the next hour.
3

Copy the password

Raff Guardian makes a password of at least 20 characters on the server. New password for the account opens in your browser with the password: click Copy, then I saved it.
The password is shown only to you, in the browser you asked from. Raff keeps only a copy sealed to a key that never leaves your browser, and it cannot open that copy:
  • I saved it deletes the copy at once.
  • Otherwise you can show it again for 10 minutes after you first see it; then Raff deletes the copy.
  • A password nobody opened is deleted after 24 hours.
Every new password sends a security email to the project’s members: “A new Windows password was set”. The email never contains the password. If Raff cannot send the email, nothing changes: “Raff Guardian cannot send the security email for a new password just now. Nothing changed. Try again in a minute.” If auto sign-in uses the account, Raff Guardian gives it the new password too, so the account still signs in by itself after a restart.

​
What you cannot change here

​
Turn these actions off

Each action has its own setting under Settings, Advanced: choose for each action, in the Users group: Sign out Windows users, Unlock Windows users and New passwords for Windows users. Each takes Ask me (the default) or Off. With Ask me, your press is the approval; with Off, the button stays visible but disabled, for example “Signing users out is off in Raff Guardian’s settings. Set it to Ask me first.”

​
Verify

The account’s line updates within a minute or two: the session is gone, the lock is gone, or “Password set on” shows today. Each action and its result is also in Activity.

​
Next steps

Automatic blocking and lockout

Why bots no longer lock your accounts out.

Privacy and data

What Raff Guardian reads about users, and what it never reads.
Last modified on October 16, 2026