0
I know how to use qwinsta/query to find out who is connected to a given machine via Remote Desktop, but the info printed out doesn't tell me from which machine it is the connection coming from. How can I get that info?
0
I know how to use qwinsta/query to find out who is connected to a given machine via Remote Desktop, but the info printed out doesn't tell me from which machine it is the connection coming from. How can I get that info?
0
Use the following command to check out the machine remotely connected.
psexec \\remoteMachine -u user -p pswrd netstat | find "3389"
Hope this helps.
Yes, as Iszi commented above. And I'm not coming from a Microsoft OS, so no psexec. – HASM – 2014-10-20T20:58:05.293
I've downloaded PsExec
and it's working fine, but what's the intention of netstat | find "3389"
? On my system, this is not giving any information. Is there another way to determine who is accessing a system? – Dominique – 2016-12-13T10:14:38.220
0
Why not use PsLoggedOn -l \\<remote_PC>
? The PsLoggedOn
tool comes with PsExec installation.
That only tells who is logged on locally, not if it is a remote desktop connection, neither where that remote desktop connection comes from, which was the question. – HASM – 2016-12-14T13:34:04.390
My first thought: Use PsExec or something similar to get a remote shell on the system, then use
netstat | find "3389"
. I'm not sure if there's another Microsoft tool that will get you the information more gracefully - especially if you happen to be limited to the command line. – Iszi – 2014-10-20T20:38:37.877That seems to work, and yes command line as even qwinsta is being ran remotely, and by that I mean ran netstat via winexe and grepping locally. – HASM – 2014-10-20T20:52:45.353