Skip to main content

​
When detection isn’t enough — stop the activity in 15 seconds

Detecting an incident is necessary; stopping it is harder. Most monitoring tools alert you when a user does something forbidden — at which point the user is still doing it, and your security team has to manually call IT to disable the account, while the data is already on its way out the door. By the time the response chain completes, the damage is done. Some platforms support automated response, but they mostly require a separate SOAR product and a workflow that crosses two or three vendors. Syteca user blocking is the same idea, built into the same Client you’re already running. Block manually while watching a session in progress (with a 15-second warning the user sees on their screen), or configure any alert to automatically block on trigger. The user is forcibly logged out across all Clients, can’t log back in, and stays on the Blocked Users list until an admin manually removes them. No second product.
Use Syteca user blocking when you need to:
  • Cut off insider threats in real time — credential abuse, privileged data theft, evidence destruction in progress.
  • Stop session-level incidents instantly while you investigate — no waiting on IT to disable the AD account.
  • Build automated response into your alert rules — define what triggers immediate blocking (specific file uploads, prohibited applications, time-of-day violations) and have it happen without human latency.
  • Enforce emergency access revocation for contractors, terminated employees, or compromised accounts across every Client at once.
  • Document a complete incident-response audit trail — who blocked whom, when, why, and from which Client.
Pair it with Alerts — alerts detect the trigger, blocking is the response. Together they’re the full detect-and-stop pipeline.
Windows Clients only. User blocking is not currently supported on macOS or Linux Clients.
Blocking users requires the administrative Client Installation and Management permission. The Block User button is disabled for users already on the Blocked Users list and for administrators without this permission.

​
How blocking works

When you block a user — manually or via alert — three things happen:
  1. A warning message appears on the user’s Client desktop (for live sessions), and the desktop is blocked.
  2. After a configurable forced-logout time (default: 15 seconds for live sessions), the user is forcibly logged out.
  3. The user is added to the Blocked Users list, either for the current Client only or for all Clients in the system.
If the user tries to log in again, they see: “You have been blocked. Contact your system administrator.”
The Blocked Users list is stored on the Application Server. When you edit the list, every Client receives the update immediately. If a Client is offline at the time, it doesn’t enforce blocking for new entries until the connection re-establishes — at which point it receives the latest list.

​
Block a user manually

Block User pop-up showing On all computers / On the computer options, Forced logout time field, Message and Reason fields

The Block User dialog from the live session — pick the blocking scope, set the forced-logout countdown, and optionally provide a custom message and reason.

Manual blocking is for the moment you’re watching a session and need to stop what you’re seeing — either it’s live and you intervene in real time, or it’s a finished session and you want to prevent the user from doing it again.
1

Open the live session

On the Activity Monitoring page, click the live session to open it in the Session Viewer.
2

Click Block User

In the main Session Player pane, click the red Block User button at the top.
3

Set the blocking scope and options

In the Block User pop-up, configure:
4

Confirm

Click Block. The warning message and blocked desktop appear on the Client immediately; the forced logout follows after the configured time.

​
Block automatically when an alert triggers

The more powerful pattern: configure an alert rule to automatically block the user the moment it triggers. No human latency — the response happens at machine speed.
1

Open the Alerts page

Sign in to the Management Tool as a user with the Client Installation and Management permission, then click Alerts in the left navigation.
2

Add or edit the alert

Click Add Alert in the top right, or click the Edit Alert icon next to an existing alert.
3

Assign Clients

On the Edit Alert page, scroll to the Assigned Clients (or Assigned Client Groups) section and add the Clients the alert applies to.
4

Configure the warning

Scroll to the Actions section. Select Show warning message to user, and optionally edit the warning text shown to the user.
5

Enable automated blocking

In the Additional Actions drop-down, select Block user on all computers.
“Block user on all computers” applies the broadest possible block — useful for high-confidence alerts. For lower-confidence cases, consider notification-only first, then add blocking once the rule is well-tuned to minimize false positives.
6

Save

Click Finish in the bottom right.
Now, whenever a user on the assigned Client(s) triggers this alert, they’re automatically blocked across all Clients — no human intervention required.

​
What the user sees on a secondary-authentication Client

If a Windows Client has secondary user authentication enabled, the system blocks the primary-secondary user combination, not just the primary user. The flow:
  1. The user logs into the Client with their primary credentials normally.
  2. The Secondary User Authentication login window appears.
  3. The user enters their blocked secondary credentials.
  4. The system rejects the secondary credentials with: “You have been blocked. Contact your system administrator.”
The block applies only to that specific primary-secondary user combination — other secondary users using the same primary credentials (or vice versa) are unaffected unless they’re also explicitly blocked.

​
The Blocked Users list

Blocked Users list grid showing user entries with domain, scope, who blocked them, date, reason, and per-row Remove icons

The Blocked Users list — central record of every block in effect, including the secondary-authentication primary(secondary) format and the Blocked By audit trail.

The Blocked Users list is the central record of every block in effect across your deployment — who’s blocked, where, when, by whom, and why.

​
Open the Blocked Users list

Click Clients in the left navigation, then click the Clients drop-down arrow at the top of the page and select Blocked Users List from the menu.

​
The grid

​
Unblock users

When the user is unblocked, they can immediately log back into Clients again.
1

Find the user

On the Blocked Users list, find the row for the user.
2

Click Remove

Click the Remove icon next to the user.
3

Confirm

Click Remove in the confirmation message.

Alerts

Define the alert rules that can trigger automated blocking.

Alerts events tab

Triage and update the status of every alert event.

Two-factor authentication

Secondary user authentication — how blocking applies to the primary-secondary combination.

Session Viewer

Where manual blocking starts — from the live or finished session you’re viewing.