Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to determine the IP address of a remote desktop client using PowerShell (or some other method) on the server? (Windows Server 2008 R2 x64 is what I'm using)

EDIT: I find that I can grep netstat's stdout to retrieve this information which is very feasable, so how can I trigger a script/shell-command when a client connects?

share|improve this question
Within what context? Will this script be run as the user, administrator, or someone else? – Zoredache Feb 19 '12 at 8:25
Is this within a LAN, WAN, or internet? – t1nt1n Feb 19 '12 at 8:29
I leave RDP open to the internet, so I know what IPs are mine and what aren't. I'm not sure who it'll run under, I guess whatever lets me retrieve that information. – chaz Feb 19 '12 at 22:37
I did some searching, and this post ( ) looks to be very close to what you need. I'm just not proficient enough in Powershell to make it target/return and IP – Skawt Feb 20 '12 at 0:13
That event type and the information it provides still doesn't give me the remote IP, closest thing it's giving me in the event log is 'COMPUTER' – chaz Feb 20 '12 at 22:32

From a command prompt you can run the following command to get a list of the remote IPs that are connected to RDP (port 3389).

netstat -n | find ":3389" | find "ESTABLISHED"

I'm certain this can be scripted in powershell (or even just a plain old batch file). I can provide an example tomorrow if you're interested.

share|improve this answer
I've used this before it it works very effectively, now I just need to find a way to trigger a script when a RDP client connects. – chaz Feb 23 '12 at 1:53
up vote 5 down vote accepted

Alright I figured out that the task scheduler application that comes with windows is configurable to where I can run a batch script, triggered when an event in the event log is generated. Via the UI you choose the event type, event source and event ID, in which case I used 4264 (and yes is captures all logon types). Here I used a simple batch script instead:

SET logfile="rdp_ip_logs.log"
date /T>>%logfile%
time /T>>%logfile%
netstat -n | find ":3389" | find "ESTABLISHED">>%logfile%

Also I found a this super-useful example on how to subscribe/listen to event writes in .NET: I'm gonna end up using that instead to to write certain events to to a database for web-based examination.

share|improve this answer
That's actually quite an elegant solution when you put it all together. I wasn't aware of the enhanced task scheduler functionality either. Great job! – John Homer Feb 23 '12 at 20:08

If you don't need to script it, you can look in the Security event log for event ID 4624. There will be a line:

Source Network Address:

share|improve this answer
4264 is for logins and is useful for logging active domain controller type logins. I need the current IP of the connect RDP client, which account logged in is irrelevant and I believe is feasibly retrievable through grepping/piping netstat's stdout. I mean right now if there was a way to trigger the execute of a shell-command/script/program on an RDP connect, that'd be great. – chaz Feb 23 '12 at 2:01
Actually 4624(typo) is correct, there are multiple logon types that showup on that event ID. – chaz Mar 1 '12 at 7:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.