diff --git a/changes/20370-linux-nologin b/changes/20370-linux-nologin
new file mode 100644
index 0000000000..236418c963
--- /dev/null
+++ b/changes/20370-linux-nologin
@@ -0,0 +1 @@
+- Linux lock/unlock scripts now make use of pam_nologin to keep AD users locked out
diff --git a/ee/server/service/embedded_scripts/linux_lock.sh b/ee/server/service/embedded_scripts/linux_lock.sh
index 6c7e317240..f6961f3b42 100644
--- a/ee/server/service/embedded_scripts/linux_lock.sh
+++ b/ee/server/service/embedded_scripts/linux_lock.sh
@@ -29,4 +29,15 @@ do
     fi
 done
 
+# Logout any non-passwd users
+logged_in=$(users | tr ' ' '\n' | sort  | uniq)
+for user in $logged_in; do
+    [ "$user" = "root" ] && continue
+    echo "Logging out $user"
+    pkill -KILL -u "$user"
+done
+
+# Create the pam_nologin file
+touch /etc/nologin
+
 echo "All non-root users have been logged out and their accounts locked."
diff --git a/ee/server/service/embedded_scripts/linux_unlock.sh b/ee/server/service/embedded_scripts/linux_unlock.sh
index e981d4ce44..b9d0554f7a 100644
--- a/ee/server/service/embedded_scripts/linux_unlock.sh
+++ b/ee/server/service/embedded_scripts/linux_unlock.sh
@@ -19,3 +19,6 @@ do
         fi
     fi
 done
+
+# Remove the pam_nologin file
+rm /etc/nologin
diff --git a/scripts/mdm/linux/linux-lock.sh b/scripts/mdm/linux/linux-lock.sh
index 6c7e317240..f6961f3b42 100644
--- a/scripts/mdm/linux/linux-lock.sh
+++ b/scripts/mdm/linux/linux-lock.sh
@@ -29,4 +29,15 @@ do
     fi
 done
 
+# Logout any non-passwd users
+logged_in=$(users | tr ' ' '\n' | sort  | uniq)
+for user in $logged_in; do
+    [ "$user" = "root" ] && continue
+    echo "Logging out $user"
+    pkill -KILL -u "$user"
+done
+
+# Create the pam_nologin file
+touch /etc/nologin
+
 echo "All non-root users have been logged out and their accounts locked."
diff --git a/scripts/mdm/linux/linux-unlock.sh b/scripts/mdm/linux/linux-unlock.sh
index e981d4ce44..b9d0554f7a 100644
--- a/scripts/mdm/linux/linux-unlock.sh
+++ b/scripts/mdm/linux/linux-unlock.sh
@@ -19,3 +19,6 @@ do
         fi
     fi
 done
+
+# Remove the pam_nologin file
+rm /etc/nologin