Block all access until sign on is complete is fine and works great. the doc from the WBA lays it all out and it does work. That is not to say that an end user will not have issues with their device from time to time due to whatever reason but in 99.9% of those cases it is not the AP or the RF. It starts with end user education about how your wireless environment  operates.  ... View more

It is indeed possible to logout a user from splash.   If you use "Sign-on with SMS Authentication", you can only do this via dashboard. If you use "Click-through", this is network-auth.com, you can revoke a client via API.     Let me know if you need help implementing this.      ... View more

The API may work here, but something to consider. The API changes and in all honesty breaks certain times. My trust level with that in this situation would be kind of low. You are looking for more of a set it and forget it solution. In that case I would use the logoff url from the whitepaper to test. Then in a windows logoff script have it visit that page or on a scheduled interval (60mins) ... View more