Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using qwinsta and rwinsta to manage disconnected sessions at the moment. I usually get something like this:

SESSIONNAME       USERNAME                 ID  STATE   TYPE        DEVICE
console                                     0  Conn    wdcon
rdp-tcp                                 65536  Listen  rdpwd
                  Administrator             1  Disc    rdpwd

The problem is when people log on as local Administrator or more general domain accounts.

It may not be possible, but is there a command I can use to get the IPAddress (and then machine name) where the Administrator logon occurred from? I've tried quite a lot of searching around and trying all the tools I could find (sysinternal psloggedon, nbstat etc), but none could get me this information.

Can I find out who keeps leaving sessions open!

share|improve this question
This isn't a real answer, but this is an excellent reason as to why you shouldn't be using the generic Administrator account. Create seperate Administrative accounts for each person who needs access. – Dan Feb 22 '12 at 11:26
Corollary: Turn off Remote Access for the local admin account. – Posipiet Feb 22 '12 at 12:20
@Dan yes it's true that I could give separate Admin accounts, but is there any way to get session by id and then see from where the session was initiated? – dtryon Feb 22 '12 at 20:21
@Posipiet - I'll do that, but that still leaves me with general domain accounts that I don't control (not the domain admin, unfortunately) – dtryon Feb 22 '12 at 20:22
Have you considered just looking at the event log? – Zoredache Mar 1 '12 at 1:12
up vote 2 down vote accepted

You could try GETTSCIP from

It's a freeware application, but I don't know if it will work for disconnected sessions. I doubt if it will, though.

share|improve this answer
+1 for a cool toolset that I didn't now about, but the GETTSCIP tool doesn't seem to be for looking through all connected sessions. It seems to be a tool to use in order to know the ip you are connecting from when in an RDC session. So, I don't think it will help for this task. – dtryon Feb 27 '12 at 12:55
Ah, you may be right. I mainly use CAD for REMPROF and only occasionally dip into others. You're right though, handy toolset! – Dan Feb 27 '12 at 13:12
I'm going to go with this solution, but using the EVTSCIP tool in the CAD_TSUtils. It comes with a script that can be added for every user logon (usrlogon.cmd) and can be easily modified to save the IP on the server at every user logon. Thanks for the nudge towards this direction. – dtryon Mar 2 '12 at 17:43

You could try TCPView.

You launch it on your terminal server and filter it by local port ms-wbt-server and it should resolve the DNS name of the remote address for you. There is also logging options with the program but I have personally never used them.

share|improve this answer
From reading about TCPView, it seems it will only report 'active' connections to the server. As a stated, I'm really trying to track down who keeps leaving sessions open without logging out. So these are abandoned connections and come through like the example above (Disc = Disconnected). Thanks. – dtryon Feb 27 '12 at 23:32
You can keep TCPView running on your server. It can also logs disconnected sessions, you then can correlate the time of login with the TCPView logs. – Nic Young Feb 28 '12 at 0:23
I'll check it out, thanks. – dtryon Feb 28 '12 at 10:08
Thanks a lot for your suggestion! In the end I went with the ENVTSCIP tool from CAD_TSUtils, but it was good to be introduced to this tool. – dtryon Mar 2 '12 at 17:44

Not a command, but you can use Terminal Service Manager. Select the disconnected session and then open the Information tab in the right pane. Both Client Name (PC name) and Client address (IP) are available.

share|improve this answer
do you know if you can use Terminal Service Manager remotely? – dtryon Mar 1 '12 at 0:23
If your client computer is a Domain member, then you just need to install the admin tools and be login with an account that has admin privileges on the Terminal Server host. – Zoredache Mar 1 '12 at 1:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.