However, that statistic can often be misleading: due to cached sign-in capabilities in modern browsers, a user could potentially stay signed in for days. This can be misrepresented in terms of whether a user is actually using Google Apps at a given time or not, and can often be a great troubleshooting step when someone is experiencing user-specific technical problems. Here is how you can force a sign out and subsequently an entirely new log in session, no matter where the user may have their credentials cached from possible logging in at multiple locations.
From the "Organization & users" tab in your administrative console, go ahead and click on the user you would like to sign out.
Upon entering into a user's account information, you'll see the ability to reset sign-in cookies under the password reset section.
Being able to see this requires you to be an administrator and for the user in question to be a regular user. For example, an administrator is unable to see this functionality for another administrator.
Some of the issues that this may resolve include changes to domain-wide administrative sessions, problems accessing certain Google Apps services and not being able to see newly added Google Apps Marketplace apps prior to the previous sign-in. Much like rebooting a computer, signing out of Google Apps domain-wide is a great troubleshooting step when something is not working quite right.
Have you ever used your administrative privileges to sign a user out? Did you do it for troubleshooting purposes?