Win32_LogonSessions returns older sessions

Question

I'm trying to identify logged sessions using a WMI query using PowerShell with:

$logon_sess = @(gwmi win32_logonsession -ComputerName $computername)

But I see that this command is also reporting older sessions, are these still active? How can I reset it?

And when I compare the results with the "query user" command, I see different results because "Query user" command returns only current sessions.

Then, how can I get real result of existing sessions using WMI Win32_LogonSession method?

Answer 1

You are observing this behavior because Microsoft Security Bulletin MS16-111 contains an update that changed the way that Windows handles logon session objects. Now any service or application, either Microsoft or 3rd party, that leaks access tokens, now also leaks logon session objects.

You are leaking logon session objects every time a user logs off the system, and there isn't anything you can do about it except get your service or application vendor to fix their code so that it no longer leaks tokens.

https://blogs.technet.microsoft.com/askds/2017/04/05/using-debugging-tools-to-find-token-and-session-leaks/