I see this problem approached by enumerating the users within the specific
group(s) and logging them off.  But how do I log them off.

David

You can do a NetSessionEnum and then a NetSessionDel to end a session
between a client & server. However, this doesn't mean that the user has been
logged off as it's equivalent to disconnecting from a network share. The
user can always restablish that connection at a later time after you have
terminated the session. Also, the security token given to that user when
they logged onto the domain is not lost because you performed this
operation - it remains intact.

Marc