Hi guys,
I have a bit of an odd request here. I have a requirement to pull a list of currently signed-in Remote Desktop (both active and disconnected) users on a remote system via powershell.
If at all possible, I would prefer to avoid using query user (quser) or query session (qwinsta) simply due to the length of time it can take to retrieve the data using those commands, as well as in the environment that I'm in, they only appear to work about 15-20% of the time.
I would also prefer to avoid installing any additional powershell modules if I can, since some of the networks I will be running this script on wont have any connection to the internet to pull the modules from.
I have looked at pulling a list of all users on the system who have an 'Explorer.exe' process running, but that doesn't differentiate between locally signed in users and remote users.
I'm running into a bit of a wall here, I cant seem to find anything online that would fit the bill.
Get-CimInstance -ClassName Win32_LogonSession -Filter "LogonType = 10" will get you the logged on users. You can use -ComputerName to run it on a remote computer, or create an array of CimSessions and pass that to -Session to automatically parallelize it across many systems.
If it's RDS, there are special rda cmdlets specifically for that. Pretty easy to use
windows - How to get all remote computer's usernames via Powershell? - Stack Overflow
shell script - how to list users in linux?…local, remote, real and all users - Unix & Linux Stack Exchange
List of computers - Need to find which user is logged in
Pull list of mapped drives remotely?
Videos
It (csv file) should be formatted as follows:
computername
server1
server2
server3
'Computername' is the column name. This can be derived from the code snippet as the Foreach-Object refers to the ComputerName property.
Try this
function Get-MyLoggedOnUsers
{
param([Array]$Computer)
Get-WmiObject Win32_LoggedOnUser -ComputerName $Computer |
Select __SERVER, Antecedent -Unique |
%{"{0} : {1}\{2}" -f $_.__SERVER, $_.Antecedent.ToString().Split('"')[1], $_.Antecedent.ToString().Split('"')[3]}
}
$Computers = gc C:\Temp\Computers.txt
Get-MyLoggedOnUsers $Computers
-or-
I found this one and modified it to my needs
<#
.Synopsis
Queries a computer to check for interactive sessions
.DESCRIPTION
This script takes the output from the quser program and parses this to PowerShell objects
.NOTES
Name: Get-LoggedOnUser
Author: Jaap Brasser
Version: 1.1
DateUpdated: 2013-06-26
.LINK
http://www.jaapbrasser.com
.PARAMETER ComputerName
The string or array of string for which a query will be executed
.EXAMPLE
.\Get-LoggedOnUser.ps1 -ComputerName server01,server02
Description:
Will display the session information on server01 and server02
.EXAMPLE
'server01','server02' | .\Get-LoggedOnUser.ps1
Description:
Will display the session information on server01 and server02
#>
param(
[CmdletBinding()]
[Parameter(ValueFromPipeline=$true,
ValueFromPipelineByPropertyName=$true)]
[array[]]$ComputerName = (gc C:\Temp\TSRA.txt)
)
process {
foreach ($Computer in $ComputerName) {
quser /server:$Computer | Select-Object -Skip 1 | ForEach-Object {
$CurrentLine = $_.Trim() -Replace '\s+',' ' -Split '\s'
$HashProps = @{
UserName = $CurrentLine[0]
ComputerName = $Computer
}
# If session is disconnected different fields will be selected
if ($CurrentLine[2] -eq 'Disc') {
$HashProps.SessionName = $null
$HashProps.Id = $CurrentLine[1]
$HashProps.State = $CurrentLine[2]
$HashProps.IdleTime = $CurrentLine[3]
$HashProps.LogonTime = $CurrentLine[4..6] -join ' '
} else {
$HashProps.SessionName = $CurrentLine[1]
$HashProps.Id = $CurrentLine[2]
$HashProps.State = $CurrentLine[3]
$HashProps.IdleTime = $CurrentLine[4]
$HashProps.LogonTime = $CurrentLine[5..7] -join ' '
}
New-Object -TypeName PSCustomObject -Property $HashProps |
Select-Object -Property UserName,ComputerName,SessionName,Id,State,IdleTime,LogonTime
} | Out-GridView -Title "Users Logged in $Computer"
}
}
You can use the commands listed here to manage Terminal Server connections. query session /server:<servername> is probably the first one you want.
These all require remote procedure call, which is part and parcel with CIFS/SMB (the IPC$ share). Check that the RPC service is enabled first. Second, you can't/shouldn't (depending on network configuration) run these services over anything but the local network. If you're trying to do this sort of management over the Internet, you should be using a VPN or some creative SSH tunneling.
Use the eventvwr to remotely view the security log for the remote computer, and scroll through the security logs until you find a login event for the other user:
eventvwr [remote computer name without brackets]
Hi
I have a list of computer names and need to find the users who are using these computers.
How to fetch these users details via powershell?
Thanks
