Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to be able to create a powershell script that will tell me, for all RDP sessions currently active on a machine, who the user is, and what their clientname (machine name) is.

I can use a combination of win32_loggedonnuser and win32_logonsession to get the username information, but I can't find the client name in these objects (enumerations?).

PS C:\> $logons = gwmi win32_loggedonuser; $lstring = ""; foreach($l in $logons) { $lstring +=$l;} $lstring -match "cephalopod";
PS C:\> $sessions = gwmi win32_logonsession; $sstring = ""; foreach($s in $sessions) { $sstring +=$s;} $sstring -match "cephalopod";

(cephalopod is my machine name, the machine that's logged into the server box)


I can see that HKCU:\Volatile Environment does have the client name, and the temp key has the user name within it, but I can't establish from the keys alone if the session is currently active.

Am I missing an API call that will get me all this information in one place?

Basic requirement: grep out the Task Manager > Users listing for user and client name, where status is active.

share|improve this question

There is no WMI interface for this that I know of.

Am I missing an API call that will get me all this information in one place?

Yep. You can get the data from the Win32 API. From wtsapi32.dll, to be specific. You can write a C program, or you can P/Invoke it from C# or even Powershell.

Since you probably want Powershell, I wrote this for you this morning:

# QuerySessionInformation.ps1
# Written by Ryan Ries, Jan. 2013, with help from MSDN and Stackoverflow.

$Code = @'
using System;
using System.Collections.Generic;
using System.Text;
using System.Runtime.InteropServices;
public class RDPInfo
    static extern IntPtr WTSOpenServer([MarshalAs(UnmanagedType.LPStr)] String pServerName);

    static extern void WTSCloseServer(IntPtr hServer);

    static extern Int32 WTSEnumerateSessions(
        IntPtr hServer,
        [MarshalAs(UnmanagedType.U4)] Int32 Reserved,
        [MarshalAs(UnmanagedType.U4)] Int32 Version,
        ref IntPtr ppSessionInfo,
        [MarshalAs(UnmanagedType.U4)] ref Int32 pCount);

    static extern void WTSFreeMemory(IntPtr pMemory);

    static extern bool WTSQuerySessionInformation(System.IntPtr hServer, int sessionId, WTS_INFO_CLASS wtsInfoClass, out System.IntPtr ppBuffer, out uint pBytesReturned);

    private struct WTS_SESSION_INFO
        public Int32 SessionID;
        public String pWinStationName;
        public WTS_CONNECTSTATE_CLASS State;

    public enum WTS_INFO_CLASS


    public static IntPtr OpenServer(String Name)
        IntPtr server = WTSOpenServer(Name);
        return server;

    public static void CloseServer(IntPtr ServerHandle)

    public static void ListUsers(String ServerName)
        IntPtr serverHandle = IntPtr.Zero;
        List<String> resultList = new List<string>();
        serverHandle = OpenServer(ServerName);

            IntPtr SessionInfoPtr = IntPtr.Zero;
            IntPtr userPtr = IntPtr.Zero;
            IntPtr domainPtr = IntPtr.Zero;
            IntPtr clientNamePtr = IntPtr.Zero;
            Int32 sessionCount = 0;
            Int32 retVal = WTSEnumerateSessions(serverHandle, 0, 1, ref SessionInfoPtr, ref sessionCount);
            Int32 dataSize = Marshal.SizeOf(typeof(WTS_SESSION_INFO));
            Int32 currentSession = (int)SessionInfoPtr;
            uint bytes = 0;
            if (retVal != 0)
                for (int i = 0; i < sessionCount; i++)
                    WTS_SESSION_INFO si = (WTS_SESSION_INFO)Marshal.PtrToStructure((System.IntPtr)currentSession, typeof(WTS_SESSION_INFO));
                    currentSession += dataSize;

                    WTSQuerySessionInformation(serverHandle, si.SessionID, WTS_INFO_CLASS.WTSUserName, out userPtr, out bytes);
                    WTSQuerySessionInformation(serverHandle, si.SessionID, WTS_INFO_CLASS.WTSDomainName, out domainPtr, out bytes);
                    WTSQuerySessionInformation(serverHandle, si.SessionID, WTS_INFO_CLASS.WTSClientName, out clientNamePtr, out bytes);

                    if(Marshal.PtrToStringAnsi(domainPtr).Length > 0 && Marshal.PtrToStringAnsi(userPtr).Length > 0)
                        if(Marshal.PtrToStringAnsi(clientNamePtr).Length < 1)                       
                            Console.WriteLine(Marshal.PtrToStringAnsi(domainPtr) + "\\" + Marshal.PtrToStringAnsi(userPtr) + "\tSessionID: " + si.SessionID + "\tClientName: n/a");
                            Console.WriteLine(Marshal.PtrToStringAnsi(domainPtr) + "\\" + Marshal.PtrToStringAnsi(userPtr) + "\tSessionID: " + si.SessionID + "\tClientName: " + Marshal.PtrToStringAnsi(clientNamePtr));
        catch(Exception ex)
            Console.WriteLine("Exception: " + ex.Message);

Add-Type $Code

Copy all of that into a file named QuerySessionInformation.ps1. Now launch the 32 bit version of Powershell in C:\Windows\SysWOW64\WindowsPowershell\v1.0. The code above uses pointers that will not work in a native 64 bit environment.

Now run the script. If you've never run the 32 bit version of Powershell on that server before, you will need to modify the script execution policy with Set-ExecutionPolicy, as 32 bit and 64 bit Powershell have separate execution policies. Note that there should be no output from the script itself, as all it is doing is compiling the .NET code and adding it to the current environment. Also note that once a type is added with Add-Type, you can not unload it without exiting that Powershell session... AFAIK. It makes debugging this sort of stuff really annoying as you have to restart Powershell every time you modify the code.

Now that the code is loaded, type this:

PS C:\> [RDPInfo]::ListUsers("REMOTESERVER")

If there are any active user sessions on REMOTESERVER, the output will look like this:

DOMAIN\UserName  SessionID: 2    ClientName: RYAN-PC

This will work on remote computers as well as the local computer, but beware that if the user running this does not have sufficient permissions to the remote computer, it will fail silently (no output.)

Edit: There are other bits of info in WTS_INFO_CLASS that may be of interest to you, such as WTSConnectState and WTSClientAddress. All you have to do is query for them.

Edit: I have also converted this solution to native code (C) for use on the command line:

share|improve this answer
......dude..... – MDMarra Jan 13 '13 at 20:00

Would PS Terminal Services (for Powershell) do the trick? I use this all the time on our 10 Terminal Servers.

  1. Download it and install it from this link
  2. PS > Import-Module PSTerminalServices
  3. PS > Get-tssession -computername {name}

This is a wonderful utility.

share|improve this answer

Execute quser /server:[the servers name] >[the path to the text file].txt

It lists all of the info, pipes it to a space delimited text file so it can easily be imported & dissected. Works great and avoids any complexities of calling native APIs that are 32 or 64 bit dependent. Can be done all in managed code if it's a .Net focused app.

share|improve this answer

might be more useful to you :)

share|improve this answer
qwinsta outputs the device name as rdp-tcp#0, etc; not the client name, or client connecting machine name. So this doesn't help me. – glasnt Dec 27 '11 at 21:39
yeah it's a bit of pickle really. You may have to look to the security audit events, although that may be a bit of a pain. – Preflightsiren Dec 31 '11 at 0:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.