Fix ERROR_CTX_NO_FORCE_LOGOFF (0X00001B97) on RDS

Quick answer: Enable the Group Policy 'Deny logoff of a Remote Desktop Services session user' or set the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fResetBroken to 0.

What's happening?

You're trying to force a user off a Remote Desktop Services (RDS) session, and Windows kicks back with ERROR_CTX_NO_FORCE_LOGOFF (0X00001B97) — "The user %s\%s is already logged on to the console of this computer." I know this error is infuriating because it seems like Windows is just refusing to do what you asked.

This tripped me up the first time too. The user is physically signed in at the console (or their session is cached there), and the RDS policy says "you can't log off a console session." It's a safety measure — Microsoft assumes you don't want an admin booting someone off the server's own keyboard. But when you're using RDS in a lab or a single-server setup, that safety measure becomes a headache.

I've seen this most often on Windows Server 2019 and 2022 after an unexpected restart or when a user leaves their session open on the console and walks away. The error shows up in Event Viewer under TerminalServices-SessionBroker (event ID 2050) or in your remote management tool.

Fix 1: Enable the Group Policy setting

1. Open gpedit.msc (Group Policy Management Console) on the RDS server.
2. Go to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections.
3. Find "Deny logoff of a Remote Desktop Services session user". Double-click it.
4. Set it to Enabled. Yes, you read that right — enabling this policy tells Windows it's okay to let you log off console sessions.
5. Click OK and close the editor.
6. Run gpupdate /force from an admin command prompt.
7. Try your logoff operation again. It should work now.

This policy was added specifically to fix this error. If it's not there (older Windows builds), move to Fix 2.

Fix 2: Registry tweak (if GPEdit isn't available)

1. Open regedit as Administrator.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services.
3. If the key doesn't exist, right-click Terminal Services and create a new key named Terminal Services — wait, that's already the path. Actually, make sure you're at Terminal Services and create a DWORD (32-bit) named fResetBroken.
4. Set its value to 0.
5. Close regedit.
6. Reboot the server or restart the Remote Desktop Services service (net stop TermService && net start TermService).

Still stuck? Try these alternatives

• Reset the session from command line: Run query session to find the session ID, then reset session <ID> — this often bypasses the error.
• Use PowerShell:

  Get-WmiObject -Class Win32_Process -Filter "Name='explorer.exe'" | ForEach-Object { $_.Terminate() }

  This kills the user's shell, which forces a logoff.
• Shadow the session: mstsc /shadow:<sessionID> lets you take over the console session, then you can log them off normally.
• Check for disconnected sessions: Run qwinsta to see sessions in "Disc" state. If you see one, logoff <sessionID> directly (sometimes this works when the GUI fails).

Prevention tip

Set a group policy on your RDS servers to automatically disconnect idle sessions after 15 minutes. Go to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits — enable "Set time limit for disconnected sessions" to 1 minute. That way, no one gets stuck on the console long enough to cause this error. I also recommend setting "End session when time limits are reached" to Enabled. That's the real fix — stop the problem before it starts.