I would like to know if it is posible to get the current usernames of remotely logged in users on a computer? From windows cmd?
Kind of: WMIC /NODE:ComputerName ComputerSystem Get Username
This command works, but gives the users logged in locally to ComputerName. Not the ones who are remotely logged in.
Thank you for your help!
I use this one for my environment, modified slightly to just pull the filter of only the computers I want. It came out sometime last year I think...works well enough for me on 2008 R2. Haven't tested it on 2012 though. I just have it scheduled to run daily.
http://gallery.technet.microsoft.com/scriptcenter/PowerShell-script-to-Find-d2ba4252
# Import the Active Directory module for the Get-ADComputer CmdLet
Import-Module ActiveDirectory
# Get today's date for the report
$today = Get-Date
# Setup email parameters
$subject = "ACTIVE SERVER SESSIONS REPORT - " + $today
$priority = "Normal"
$smtpServer = "YourMailServer"
$emailFrom = "email@yourdomain.com"
$emailTo = "email@yourdomain.com"
# Create a fresh variable to collect the results. You can use this to output as desired
$SessionList = "ACTIVE SERVER SESSIONS REPORT - " + $today + "`n`n"
# Query Active Directory for computers running a Server operating system
$Servers = Get-ADComputer -Filter {OperatingSystem -like "*server*"}
# Loop through the list to query each server for login sessions
ForEach ($Server in $Servers) {
$ServerName = $Server.Name
# When running interactively, uncomment the Write-Host line below to show which server is being queried
# Write-Host "Querying $ServerName"
# Run the qwinsta.exe and parse the output
$queryResults = (qwinsta /server:$ServerName | foreach { (($_.trim() -replace "\s+",","))} | ConvertFrom-Csv)
# Pull the session information from each instance
ForEach ($queryResult in $queryResults) {
$RDPUser = $queryResult.USERNAME
$sessionType = $queryResult.SESSIONNAME
# We only want to display where a "person" is logged in. Otherwise unused sessions show up as USERNAME as a number
If (($RDPUser -match "[a-z]") -and ($RDPUser -ne $NULL)) {
# When running interactively, uncomment the Write-Host line below to show the output to screen
# Write-Host $ServerName logged in by $RDPUser on $sessionType
$SessionList = $SessionList + "`n`n" + $ServerName + " logged in by " + $RDPUser + " on " + $sessionType
}
}
}
# Send the report email
Send-MailMessage -To $emailTo -Subject $subject -Body $SessionList -SmtpServer $smtpServer -From $emailFrom -Priority $priority
# When running interactively, uncomment the Write-Host line below to see the full list on screen
$SessionList
Since everyone else is throwing in their hat on this one, I guess I might as well too.
I have been using what @TheCleaner suggested with the qwinsta.exe to monitor active users on Terminal Servers but that only outputs in text.
But I've recently discovered the Win32_UserProfile class which is very promising as I can now output in objects to use in PS.
This is what I've got so far:
Get-WmiObject Win32_Profile -ComputerName $Name -Filter "Loaded='True'" | Foreach {$_.LocalPath}
**Note: You may need to filter some "Loaded" Profiles by discarding all results in which the $_.LocalPath value is not in the C:\Users folder.
If it doesn't have to run from cmd ... I use an awesome little util called NetScan to do this for me.
One easy solution is to enumerate the instances of EXPLORER.EXE running on the remote host. Then just pull the owning user.
Example PS command:
Get-WmiObject -Class Win32_Process -Filter "Name='explorer.exe'" -ComputerName "REMOTECOMPUTER" | ForEach-Object{ "{0}\{1}" -f $_.GetOwner().Domain, $_.GetOwner().User }
