When I run the qwinsta /server:somesrv
command in cmd
I can get a listing of all the current RDP sessions that are logged into a particular Windows server.
SESSIONNAME USERNAME ID STATE TYPE DEVICE
console 0 Conn wdcon
rdp-tcp 65536 Listen rdpwd
rdp-tcp#594 tom1 1 Active rdpwd
rdp-tcp#595 bob1 2 Active rdpwd
Is it possible to get a list like this on a remote server from Powershell so that the data can be used elsewhere?
There are multiple alternatives:
qwinsta
to objects. Easy solution. See example belowCassia.DLL
.Net wrapper to access the native APIs that qwinsta
runs behind the scene. This is the class that the TS Module uses. More difficult, but will have the benefit of being customized to your needs.Cassia.DLL
accesses using P/Invoke (wtsapi32.dll
, kernel32.dll
, winsta.dll
). Hard and overcomplicated.PowerShell-wrapper for qwinsta
function Get-TSSessions {
param(
$ComputerName = 'localhost'
)
$output = qwinsta /server:$ComputerName
if ($null -eq $output) {
# An error occured. Abort
return
}
# Get column names and locations from fixed-width header
$columns = [regex]::Matches($output[0],'(?<=\s)\w+')
$output | Select-Object -Skip 1 | Foreach-Object {
[string]$line = $_
$session = [ordered]@{}
for ($i=0; $i -lt $columns.Count; $i++) {
$currentColumn = $columns[$i]
$columnName = $currentColumn.Value
if ($i -eq $columns.Count-1) {
# Last column, get rest of the line
$columnValue = $line.Substring($currentColumn.Index).Trim()
} else {
$lengthToNextColumn = $columns[$i+1].Index - $currentColumn.Index
$columnValue = $line.Substring($currentColumn.Index, $lengthToNextColumn).Trim()
}
$session.$columnName = $columnValue.Trim()
}
# Return session as object
[pscustomobject]$session
}
}
Get-TSSessions -ComputerName "localhost" | Format-Table -AutoSize
SESSIONNAME USERNAME ID STATE TYPE DEVICE
----------- -------- -- ----- ---- ------
services 0 Disc
console Frode 1 Active
#This is objects, so we can manipulate the results to get the info we want. Active sessions only:
Get-TSSessions -ComputerName "localhost" | Where-Object State -eq 'Active' | Format-Table -AutoSize SessionName, UserName, ID
SESSIONNAME USERNAME ID
----------- -------- --
console Frode 1