What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Ubuntu Desktop can hide and lock GNOME’s normal Log Out action with the dconf key /org/gnome/desktop/lockdown/disable-log-out. For a system-wide kiosk or managed-terminal policy, define that key in the local dconf database, lock it so users cannot change it, run sudo dconf update, and start a new session or reboot. Set disable-user-switching=true as well when users must not bypass the restriction by switching accounts. This controls GNOME’s desktop actions; it does not replace account security, physical access controls, or a separate administrator recovery procedure.
What is the correct way to disable logout on Ubuntu Desktop?
The supported system-wide method is a GNOME dconf lockdown policy. Ubuntu’s policy key is a Boolean, /org/gnome/desktop/lockdown/disable-log-out, and its normal default is false. Set it to true in the local system database, lock the key, rebuild dconf’s databases, then begin a fresh session.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteThis approach is appropriate for unmanned kiosks, public terminals, reception displays, classroom stations, and other managed deployments where the signed-in session is expected to stay active. It is not a substitute for restricting terminal access, rebooting, remote administration, or account permissions.
Why should I disable user switching at the same time?
GNOME warns that a user can evade a logout lockdown by switching to a different user. Therefore, a kiosk policy that only hides Log Out is incomplete when the user-switching control remains available.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Use both Boolean settings when the requirement is “keep this session and prevent the person at the keyboard from moving to another account”:
disable-log-out=trueremoves the normal GNOME logout action.disable-user-switching=trueremoves the documented bypass through account switching.
Apply these restrictions only where the operational goal justifies them. Before deployment, decide how an administrator will recover the machine: for example, through a separately controlled administrator account, remote management, or a maintenance procedure that does not depend on the kiosk user’s desktop menu.
What files and settings do I need for a system-wide policy?
A system-wide dconf policy uses four pieces: the user dconf profile, a local keyfile containing the values, a locks file that prevents users from changing those values, and a database rebuild with dconf update.
1. Define the dconf profile
Create or edit /etc/dconf/profile/user with exactly this profile order:
user-db:user
system-db:localThe profile tells GNOME to load the individual user database and then the local system database. The local database is where the administrator’s policy is stored.
2. Add the logout lockdown keyfile
Create /etc/dconf/db/local.d/00-logout and enter:
[org/gnome/desktop/lockdown]
# Prevent the user from logging out
disable-log-out=true
# Recommended for managed or kiosk deployments
disable-user-switching=trueThe section name corresponds to the GNOME lockdown schema. The comments are optional; the two Boolean assignments are the policy.
3. Lock the values
Create /etc/dconf/db/local.d/locks/lockdown with:
# Lock user logout
/org/gnome/desktop/lockdown/disable-log-out
# Lock user switching
/org/gnome/desktop/lockdown/disable-user-switchingA keyfile sets a value, but without a lock a user may be able to change that value in their own settings. The locks file makes the local system policy authoritative for users covered by the profile.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
4. Rebuild the dconf databases
Run:
sudo dconf updateThe command compiles the keyfiles into the system dconf databases. It does not retroactively redraw every already-open GNOME session, so restart the computer or sign out through an administrator-controlled maintenance path and begin a fresh session before judging the result.
How do I apply the change safely?
Use this sequence on a test machine or maintenance window first. Keep an administrator recovery route available before locking the policy on a public or remote system.
- Open a root-capable editor for
/etc/dconf/profile/user; create the parent directories if this is a new dconf configuration. - Enter the two profile lines in the order shown above and save the file.
- Create
/etc/dconf/db/local.d/00-logoutwith the lockdown section and Boolean values. - Create the
/etc/dconf/db/local.d/locksdirectory if necessary, then save the locks file aslockdown. - Run
sudo dconf updateand check that it completes without a file-permission or syntax error. - Reboot, or start a new GNOME session using your approved administrator procedure.
- Confirm that the ordinary Log Out action is unavailable and that user switching is unavailable when that second key was enabled.
Do not test the policy by intentionally losing access to the only administrator account. A kiosk that cannot be serviced is an operational failure even if the menu item is hidden correctly.
What is the difference between a user setting and a locked system policy?
The important distinctions are scope, whether the user can undo the setting, and whether account switching remains a bypass.
| Approach | Scope | User can change it? | Switching bypass | Best use |
|---|---|---|---|---|
| User-level preference | One user’s GNOME profile | Normally yes | Usually still available unless separately restricted | Personal experiments or a temporary workstation preference |
| System dconf keyfile without locks | Users covered by the system dconf profile | Potentially; the setting is not locked | Still available unless disable-user-switching is also set |
Testing a policy before enforcement |
| System dconf keyfile plus locks | Users covered by the system dconf profile | No, through normal user settings | Closed when the user-switching key is also locked | Managed terminals, kiosks, and controlled workflows |
The documented GNOME administrator method is the third option. The locks file is what changes a preference-like value into an enforced desktop policy. Enforcement still applies only within the GNOME session and account coverage defined by the dconf profile.
Does this remove every way to end a session?
No. It disables the normal GNOME logout action represented by the lockdown key. It does not replace operating-system access controls, account administration, physical security, remote management, or procedures such as rebooting the machine.
Consider the policy as a user-interface and session-management restriction, not as a guarantee that a determined administrator or someone with physical access can never terminate the session. A deployment should document who is allowed to recover the machine and how that recovery is performed without handing the kiosk user unrestricted privileges.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Is automatic idle logout the same setting?
No. Preventing the user from choosing Log Out is separate from ending an inactive session automatically. GNOME documents idle-session behavior under the power plugin keys org.gnome.settings-daemon.plugins.power/sleep-inactive-*-type.
Do not change those power settings merely because you want to hide Log Out. GNOME warns that automatically ending an idle session can discard unsaved work. If an unattended terminal also needs an inactivity policy, design and test that policy separately, with an explicit decision about what happens to open applications and unsaved data.
Which Ubuntu versions support this lockdown key?
Canonical’s current stable ADSys policy reference lists the key as supported on Ubuntu 22.04, 24.04, 25.10, and 26.04. The exact desktop behavior can still depend on the installed GNOME session and the way the machine is managed, so verify the result in the image you deploy rather than assuming every desktop customization behaves identically.
The key’s documented default is false. A machine that has not received the local policy therefore normally keeps the standard logout action.
Free tools Windows power users keep installed
One-click scans. No signup required.
How can I verify that the policy is active?
Verification should cover both the database value and the visible desktop behavior. Perform checks after the new session has started.
Check the effective values
From the affected session, read the keys with:
dconf read /org/gnome/desktop/lockdown/disable-log-out
dconf read /org/gnome/desktop/lockdown/disable-user-switchingThe expected output for the enforced configuration is true for each key. If a value is empty or reports false, inspect the profile path, keyfile section, spelling, and whether the session was restarted after dconf update.
Check the desktop
- Open the GNOME system menu and confirm that the ordinary Log Out action is not offered.
- Open the account or session controls and confirm that switching users is unavailable when that policy is enabled.
- Test with a normal managed user, not only the administrator account used to configure the machine.
- Confirm that your documented administrator recovery method still works.
What should I troubleshoot if logout is still available?
Most failures come from a profile or deployment issue rather than from the Boolean itself. Work through these checks in order.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
The file was saved in the wrong location
System policy files belong under /etc/dconf. Confirm that the profile is exactly /etc/dconf/profile/user, the keyfile is exactly /etc/dconf/db/local.d/00-logout, and the lock file is under /etc/dconf/db/local.d/locks/lockdown. A similarly named directory or a file placed in a user’s home directory will not create the documented system policy.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The profile does not name the local database
The profile must include system-db:local. Without that line, GNOME will not load the database generated from /etc/dconf/db/local.d.
The database was not rebuilt
Changing a keyfile alone is not enough. Run sudo dconf update after every policy edit, then start a fresh session. Existing processes may continue using values loaded before the rebuild.
The key is set but not locked
If the setting appears briefly and then reverts, check that the lock file contains the full slash-prefixed key paths. The lock entry for logout is /org/gnome/desktop/lockdown/disable-log-out; the entry for switching is /org/gnome/desktop/lockdown/disable-user-switching.
Only logout was disabled
If the user can still reach another account, the documented bypass remains open. Add and lock disable-user-switching=true when the requirement is a single, persistent kiosk session.
Recommended Free Tools
The test used an old session
Reboot or create a genuinely new GNOME session after updating the database. Testing from an already-running session can make a correct configuration appear ineffective.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I roll back the policy?
Plan rollback before deployment. An administrator can remove or edit the local keyfile and its corresponding lock entries, run sudo dconf update, and then start a fresh session. If you remove only the value but leave its lock, users may still be unable to change the key; if you remove only the lock, the old value may continue to apply.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Use a controlled maintenance account or remote-management channel for rollback. Do not rely on the kiosk user’s disabled desktop controls to repair a configuration that has locked them out.
When is disabling logout a good idea?
It is a good fit when the machine has a defined, managed purpose and the session must remain in place between users or tasks. GNOME specifically cites unmanned kiosks and public internet-access terminals as examples.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Appropriate: a public information kiosk, a controlled point-of-sale-style workflow, a reception display, or a lab station managed by staff.
- Use caution: shared office computers, training rooms, or any workstation where users legitimately need to end their own sessions.
- Avoid as a security shortcut: systems where the real requirement is stronger authentication, data isolation, application sandboxing, or physical access control.
For a managed deployment, pair the dconf policy with documented account roles, maintenance access, monitoring, and a tested recovery path. The lockdown solves one desktop behavior; it does not solve the entire kiosk-security problem.
What is the practical recommendation?
For a single personal desktop, disabling logout is usually unnecessary and can make routine maintenance inconvenient. For a kiosk or controlled terminal, configure both lockdown keys, lock both paths, rebuild dconf, and validate the result in a fresh session before putting the machine in public use.
Keep the policy narrowly scoped to its intended users, record the administrator recovery method, and treat automatic idle-session handling as a separate design decision because of its potential to lose unsaved work.
Frequently Asked Questions
Can I test the setting without permanently locking users out?
Yes. Create the local keyfile and run sudo dconf update without adding the locks file while you validate the desktop behavior. Add and rebuild the locks only after the test confirms that the policy matches your operational plan.
Will disabling logout affect applications that are already open?
The lockdown changes the GNOME session controls; it does not close applications or save their data. Existing programs remain subject to their own behavior, so test the kiosk image with the applications and recovery procedures you actually deploy.
How should an administrator recover a kiosk after enabling the lockdown?
Use a separately controlled administrator account, remote-management channel, or scheduled maintenance process. Document that route before deployment, because the kiosk user’s desktop will no longer provide the normal logout or user-switching controls.
Is a reboot required every time I edit the policy?
A reboot is not the only option, but a fresh GNOME session is required for reliable validation. After sudo dconf update, use your approved maintenance procedure to start a new session, then verify the effective keys and menu behavior.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
