I am trying to figure out how this situation is even occurring. A remote device is playing back something from my server but with a managed user (Guest account) but none of the actual plex home users have that device as an authorized device so I am concerned there is some loophole.
I am trying to revoke the access of that device so it has to log in to it’s own friend account to use the server but I cannot even find where it has access or what account it has access under.
In this case it’s an Apple TV device if that matters - it probably is logged into an account that used to be part of the Plex home but was bumped out but there still ought to be some way to manage access.
It would be in the “Plex Media Server.log” file. Assuming you have debug logging enabled. If not, then the info won’t be there. If they managed to finish playing something, it should also be listed in the playback history under your dashboard.
I did not have debug logging enabled unfortunately and they did finish watching it but the line item only says Guest for user and the device name (which I cannot locate anywhere to de-authorize). No email.
Shouldn’t the Guest account, if it holds authorizations, have a manageable interface for clearing those authorizations or if the authorization is with my own account, shouldn’t my own account be able to clear that authorization for the managed user?
This seems like a pretty major transparency loophole.
A guest account is basically a managed user. Managed users must de-authorize the device themselves. So you can log in as the guest account, then using Plex Web, remove all authorized devices, then log out of Plex Web.
this would force the user (and all users) to log in with their own account, of course you would also need to re-log in to your own devices too, so be aware.
might also be a good idea to disable guest too, unless you have a specific need for it.