Cannot reliably remove authorized devices

Plex Media Server Desktops & Laptops
1

Server Version#: 1.32.8.7639

I have a managed user for whom I want to revoke access to my server. I have removed their devices under Authorized Devices and changed my Plex account password. Despite this, their account will still show up streaming media to a device that I specifically removed from Authorized Devices. It’s as though their access token is still being treated as valid by Plex.

I’ve tested this with some of my own players, too. I removed my iPhone which caused the app to prompt me to log in next time I opened it. I removed my mac, but can still stream from the mac app without having to log in again. My mac does not appear under Authorized Devices, yet it can still stream.

This seems like a pretty massive security problem as access revocation doesn’t really seem to work with any reliability. Am I missing something?

2

Settings → Manage Library Access

Hover over their ID and click the X on the right. That’s how you un-share your server

Changing your password doesn’t change theirs

I assume you did not give them full access to your server by giving them your admin account details

3

This is an old managed non-admin account from when they were in the same house. I’ve moved users who no longer live with me to their own Plex accounts and shared library access with them, but this one user refuses to logout on their PS5, so I have to force their hand.

4

Then delete the whole managed user.

5

I don’t see how that would help at all. They could just select another managed user when launching the app.

6

Then add a PIN to each of those users.

Does this device happen to be a Roku?

7

It’s a PS5.

I could add a PIN to each user, sure, but it adds an annoying inconvenience. It also still doesn’t address the fact that there is no reliable way to deauthorize a session, which seems like a MASSIVE security issue.

1 Like
8

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.