i'd like to creat a User, which is capable of logging off other users.

We're running a three shift system in our Company. We have multiple calls coming in for workstations being locked by the user of the previous shift.
Without calling support, users have to switch off power on the machines which were locked - bad things happen sometime doing so.

I'd like to have an eDirectory user who is capable of authenticating to the machines with appropriate rights to logoff the old user. Using my admin account is working that way. The client quotes that this will log off the old user.

Which rights do i have to set for such a logoff-user? eDirectory-Rights? Policy-settings?

I tried applying dynamic local administrator via ZEN DLU, which is not enough.

Any idea?