remote desktop who is connected from where?

I know how to use qwinsta/query to find out who is connected to a given machine via Remote Desktop, but the info printed out doesn't tell me from which machine it is the connection coming from. How can I get that info?

HASM

Posted 2014-10-20T19:39:35.300

Reputation: 43

My first thought: Use PsExec or something similar to get a remote shell on the system, then use netstat | find "3389". I'm not sure if there's another Microsoft tool that will get you the information more gracefully - especially if you happen to be limited to the command line. – Iszi – 2014-10-20T20:38:37.877

That seems to work, and yes command line as even qwinsta is being ran remotely, and by that I mean ran netstat via winexe and grepping locally. – HASM – 2014-10-20T20:52:45.353

Answers

Use the following command to check out the machine remotely connected.

psexec \\remoteMachine -u user -p pswrd netstat | find "3389"

Hope this helps.

vembutech

Posted 2014-10-20T19:39:35.300

Reputation: 5 693

Yes, as Iszi commented above. And I'm not coming from a Microsoft OS, so no psexec. – HASM – 2014-10-20T20:58:05.293

I've downloaded PsExec and it's working fine, but what's the intention of netstat | find "3389"? On my system, this is not giving any information. Is there another way to determine who is accessing a system? – Dominique – 2016-12-13T10:14:38.220

Why not use PsLoggedOn -l \\<remote_PC>? The PsLoggedOn tool comes with PsExec installation.

Dominique

Posted 2014-10-20T19:39:35.300

Reputation: 1 013

That only tells who is logged on locally, not if it is a remote desktop connection, neither where that remote desktop connection comes from, which was the question. – HASM – 2016-12-14T13:34:04.390