23

Is there a way to determine the IP address of a remote desktop client using PowerShell (or some other method) on the server? (Windows Server 2008 R2 x64 is what I'm using)

EDIT: I find that I can grep netstat's stdout to retrieve this information which is very feasable, so how can I trigger a script/shell-command when a client connects?

  • Within what context? Will this script be run as the user, administrator, or someone else? – Zoredache Feb 19 '12 at 8:25
  • Is this within a LAN, WAN, or internet? – Zapto Feb 19 '12 at 8:29
  • I leave RDP open to the internet, so I know what IPs are mine and what aren't. I'm not sure who it'll run under, I guess whatever lets me retrieve that information. – chaz Feb 19 '12 at 22:37
  • I did some searching, and this post ( serverfault.com/questions/314386/listing-users-using-rdp ) looks to be very close to what you need. I'm just not proficient enough in Powershell to make it target/return and IP – Skawt Feb 20 '12 at 0:13
  • That event type and the information it provides still doesn't give me the remote IP, closest thing it's giving me in the event log is 'COMPUTER' – chaz Feb 20 '12 at 22:32
23

From a command prompt you can run the following command to get a list of the remote IPs that are connected to RDP (port 3389).

netstat -n | find ":3389" | find "ESTABLISHED"

I'm certain this can be scripted in powershell (or even just a plain old batch file). I can provide an example tomorrow if you're interested.

| improve this answer | |
  • I've used this before it it works very effectively, now I just need to find a way to trigger a script when a RDP client connects. – chaz Feb 23 '12 at 1:53
13

Alright I figured out that the task scheduler application that comes with windows is configurable to where I can run a batch script, triggered when an event in the event log is generated. Via the UI you choose the event type, event source and event ID, in which case I used 4264 (and yes is captures all logon types). Here I used a simple batch script instead:

SET logfile="rdp_ip_logs.log"
date /T>>%logfile%
time /T>>%logfile%
netstat -n | find ":3389" | find "ESTABLISHED">>%logfile%

Also I found a this super-useful example on how to subscribe/listen to event writes in .NET: http://msdn.microsoft.com/en-us/library/bb552514(v=vs.90).aspx I'm gonna end up using that instead to to write certain events to to a database for web-based examination.

The only drawback of this solution is that if you have Remote Desktop Services enabled and multiple people are connected, you cannot differentiate between them in the netstat output.

| improve this answer | |
  • 1
    That's actually quite an elegant solution when you put it all together. I wasn't aware of the enhanced task scheduler functionality either. Great job! – John Homer Feb 23 '12 at 20:08
  • for older versions scheduler you could do it with batch file and evtmon.vbs script see blogs.technet.microsoft.com/netmon/2007/02/22/… – Scott R Feb 3 '18 at 8:04
6

If you don't need to script it, you can look in the Security event log for event ID 4624. There will be a line:

Source Network Address: 192.168.xxx.xxx

| improve this answer | |
  • 4264 is for logins and is useful for logging active domain controller type logins. I need the current IP of the connect RDP client, which account logged in is irrelevant and I believe is feasibly retrievable through grepping/piping netstat's stdout. I mean right now if there was a way to trigger the execute of a shell-command/script/program on an RDP connect, that'd be great. – chaz Feb 23 '12 at 2:01
  • Actually 4624(typo) is correct, there are multiple logon types that showup on that event ID. – chaz Mar 1 '12 at 7:47
  • The source address field is blank for me on Server 2019. – bparker Sep 12 at 0:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.