rwinsta to manage disconnected sessions at the moment. I usually get something like this:
SESSIONNAME USERNAME ID STATE TYPE DEVICE console 0 Conn wdcon rdp-tcp 65536 Listen rdpwd Administrator 1 Disc rdpwd
The problem is when people log on as local Administrator or more general domain accounts.
It may not be possible, but is there a command I can use to get the IPAddress (and then machine name) where the Administrator logon occurred from? I've tried quite a lot of searching around and trying all the tools I could find (sysinternal psloggedon, nbstat etc), but none could get me this information.
Can I find out who keeps leaving sessions open!