Just found this post after looking for much the same. I do not see where in the GPO you can specify users/groups to be allowed to logoff other sessions. I was using a powershell script to do this, which worked very nicely, until I allowed a group of my support folks access. They don't have the ability to run a simple get-rdusersession without being a local admin on each of my rd hosts. I was hoping to delegate to them the ability to logoff sessions, but if they can't even list the users, well, that seems rather hopeless. :(
mpleaf