Finding at what time when a user disconnected

This topic contains 3 replies, has 3 voices, and was last updated by Profile photo of Bob McCoy Bob McCoy 1 year, 2 months ago.

  • Author
  • #28529
    Profile photo of Michael Rosenørn
    Michael Rosenørn

    I've been looking at qwinsta and query session, but as far as I can see they don't provide any time info.

    I have several users remote accessing several development servers and not all of them are very good at remembering to sign out/log off their remote sessions when they are done – instead they disconnect.

    I know that you can make Group Policies and other options that sign out people after a specific time period, but I would like to script it, so I can have exceptions depending on specific users and time since disconnect.

    So if I could find the time when a user disconnected I could schedule a daily check that compares against the disconnect time and the users, and if everything fits, sign out the users (- which in turn triggers a series of other checks and commands). The only part that I'm missing is the time information . . .


  • #28530
    Profile photo of Simeon Iksanov
    Simeon Iksanov

    you can try a 'quser' command, it shows 'idle time' on disconnected sessions

    but it returns a text, not powershell object

  • #28531
    Profile photo of Michael Rosenørn
    Michael Rosenørn

    Thanks Simeon,

    Used your suggestion and then converted it to an object using:

    (quser) -replace '\s{2,}', ',' | ConvertFrom-Csv

    Only problem with that, is that when a user is disconnected the SESSIONNAME is blank, and the values moved "up one":

    USERNAME : >user1
    SESSIONNAME : rdp-tcp#60
    ID : 2
    STATE : Active
    IDLE TIME : .
    LOGON TIME : 10-07-2015 15:10

    USERNAME : user2
    ID : Disc
    STATE : 14:39
    IDLE TIME : 22-07-2015 10:24

    However, with some creative filtering I got around that 🙂

  • #28541
    Profile photo of Bob McCoy
    Bob McCoy

    I would start with the Terminal Services module.

    Some of the times it will provide ...

    ConnectTime        : 8/13/2015 6:58:45 AM
    CurrentTime        : 8/13/2015 8:13:13 AM
    DisconnectTime     :
    LastInputTime      : 8/13/2015 8:13:13 AM
    LoginTime          : 8/13/2015 6:58:57 AM
    IdleTime           : 00:00:00.0780035

You must be logged in to reply to this topic.