WMI Logged on User

[Bob Smith]

I created a script to determaine which users were logged in via RDP to a
server, however it doesn't seem to work very well. Users who have
disconnected from the server (which I have verified by TS Manager) still show
as connected. The information I gather is no different from the connected
users. I have included the output and the code.

Output from Connected User~
AuthenticationPackage: Kerberos
Caption:
Description:
LogonId: 1455198956
LogonType: 10
Name:
Status:
Username: bsmith1
FullName: Smith, Bob

Output from Disconnected User~
AuthenticationPackage: Kerberos
Caption:
Description:
LogonId: 14551989
LogonType: 10
Name:
Status:
Username: bsmith2
FullName: Smith, Bob (2)

strComputer = "MyServer"
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")


Set colSessions = objWMI.ExecQuery _
("Select * from Win32_LogonSession Where LogonType = 10")


If colSessions.Count = 0 Then
Wscript.Echo "No interactive users found"
Else
WScript.Echo "RDP Sessions:"
For Each objSession in colSessions
wscript.Echo ""
WScript.Echo "AuthenticationPackage: " &
objSession.AuthenticationPackage
WScript.Echo "Caption: " & objSession.Caption
WScript.Echo "Description: " & objSession.Description
WScript.Echo "LogonId: " & objSession.LogonId
WScript.Echo "LogonType: " & objSession.LogonType
WScript.Echo "Name: " & objSession.Name
WScript.Echo "Status: " & objSession.Status
Set colList = objWMI.ExecQuery("Associators of " _
& "{Win32_LogonSession.LogonId=" & objSession.LogonId & "} " _
& "Where AssocClass=Win32_LoggedOnUser Role=Dependent" )
For Each objItem in colList
WScript.Echo "Username: " & objItem.Name
Wscript.Echo "FullName: " & objItem.FullName
Next
Next
End If

[Pegasus]

Post by Bob Smith
I created a script to determaine which users were logged in via RDP to a
server, however it doesn't seem to work very well. Users who have
disconnected from the server (which I have verified by TS Manager) still show
as connected. The information I gather is no different from the connected
users. I have included the output and the code.

Disconnected RDP users remain logged on forever or until their session times
out. Run the Terminal Server Manager to set an appropriate time-out.

[Bob Smith]

The disconnected users are ones who logged off. They are not visable via TS
Manager at all.

Post by Pegasus

Post by Bob Smith
I created a script to determaine which users were logged in via RDP to a
server, however it doesn't seem to work very well. Users who have
disconnected from the server (which I have verified by TS Manager) still show
as connected. The information I gather is no different from the connected
users. I have included the output and the code.

Disconnected RDP users remain logged on forever or until their session times
out. Run the Terminal Server Manager to set an appropriate time-out.

[Pegasus]

Sorry, I don't understand what you're trying to say and how this relates to
your question - please rephrase.

Post by Bob Smith
The disconnected users are ones who logged off. They are not
visable [visible] via TS Manager at all.

Post by Pegasus

Post by Bob Smith
I created a script to determaine which users were logged in via RDP to a
server, however it doesn't seem to work very well. Users who have
disconnected from the server (which I have verified by TS Manager)
still
show
as connected. The information I gather is no different from the connected
users. I have included the output and the code.

Disconnected RDP users remain logged on forever or until their session times
out. Run the Terminal Server Manager to set an appropriate time-out.

[techstress]

Post by Bob Smith
I created a script to determaine which users were logged in via RDP to a
server, however it doesn't seem to work very well. Users who have
disconnected from the server (which I have verified by TS Manager) still show
as connected. The information I gather is no different from the connected
users. I have included the output and the code.
Output from Connected User~
AuthenticationPackage: Kerberos
LogonId: 1455198956
LogonType: 10
Username: bsmith1
FullName: Smith, Bob
Output from Disconnected User~
AuthenticationPackage: Kerberos
LogonId: 14551989
LogonType: 10
Username: bsmith2
FullName: Smith, Bob (2)
strComputer = "MyServer"
Set objWMI = GetObject("winmgmts:" _
              & "{impersonationLevel=impersonate}!\\" _
              & strComputer & "\root\cimv2")
Set colSessions = objWMI.ExecQuery _
    ("Select * from Win32_LogonSession Where LogonType = 10")
If colSessions.Count = 0 Then
   Wscript.Echo "No interactive users found"
Else
   WScript.Echo "RDP Sessions:"
   For Each objSession in colSessions
          wscript.Echo ""
      WScript.Echo "AuthenticationPackage: " &
objSession.AuthenticationPackage
      WScript.Echo "Caption: " & objSession.Caption
      WScript.Echo "Description: " & objSession.Description
      WScript.Echo "LogonId: " & objSession.LogonId
      WScript.Echo "LogonType: " & objSession.LogonType
      WScript.Echo "Name: " & objSession.Name
      WScript.Echo "Status: " & objSession.Status
     Set colList = objWMI.ExecQuery("Associators of " _
         & "{Win32_LogonSession.LogonId=" & objSession.LogonId & "} " _
         & "Where AssocClass=Win32_LoggedOnUser Role=Dependent" )
     For Each objItem in colList
       WScript.Echo "Username: " & objItem.Name
           Wscript.Echo "FullName: " & objItem.FullName
     Next
   Next
End If

Petri.co.il forums by Daniel Petri > Operating Systems > Scripting
Find users logged on with Terminal Server sessions?

http://www.petri.co.il/forums/showthread.php?t=19627

[\RemS]

Post by Bob Smith
I created a script to determaine which users were logged in via RDP to a
server, however it doesn't seem to work very well. Users who have
disconnected from the server (which I have verified by TS Manager) still show
as connected. The information I gather is no different from the connected
users. I have included the output and the code.
Output from Connected User~
AuthenticationPackage: Kerberos
LogonId: 1455198956
LogonType: 10
Username: bsmith1
FullName: Smith, Bob
Output from Disconnected User~
AuthenticationPackage: Kerberos
LogonId: 14551989
LogonType: 10
Username: bsmith2
FullName: Smith, Bob (2)
strComputer = "MyServer"
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
Set colSessions = objWMI.ExecQuery _
("Select * from Win32_LogonSession Where LogonType = 10")
If colSessions.Count = 0 Then
Wscript.Echo "No interactive users found"
Else
WScript.Echo "RDP Sessions:"
For Each objSession in colSessions
wscript.Echo ""
WScript.Echo "AuthenticationPackage: " &
objSession.AuthenticationPackage
WScript.Echo "Caption: " & objSession.Caption
WScript.Echo "Description: " & objSession.Description
WScript.Echo "LogonId: " & objSession.LogonId
WScript.Echo "LogonType: " & objSession.LogonType
WScript.Echo "Name: " & objSession.Name
WScript.Echo "Status: " & objSession.Status
Set colList = objWMI.ExecQuery("Associators of " _
& "{Win32_LogonSession.LogonId=" & objSession.LogonId & "} " _
& "Where AssocClass=Win32_LoggedOnUser Role=Dependent" )
For Each objItem in colList
WScript.Echo "Username: " & objItem.Name
Wscript.Echo "FullName: " & objItem.FullName
Next
Next
End If

Maybe this can help to solve the problem ((?))
Edit GPO:
COMPUTER CONFIGURATION
\ Administrative Templates
\ Windows Components
\ Terminal Services
Enable: "Keep-Alive Connections" -> SET interval 5 minutes

"When you enable this policy and specify a keep-alive time interval, the
Terminal server periodically checks to make sure the user's session is still
connected.
What might happen if you don't enable this policy is that the network link
could go down and leave the user's session in an active but orphaned state,
and then when the link comes back up the user won't be able to reconnect to
their session on the server because it is considered active (in use) and not
disconnected. The user may then start a new Terminal Services session,
leaving the orphaned session still running on the server and consuming
resources that could be used for other users."


\Rems