locked
gwmi (Get-WMIObject) get different results intermittently RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    I run gwmi on WIN2012R2, get different results as below. Don't know why? is it normal? Thanks!

    See the screen shots below. The PowerShell version is 4.0.

    Sometime I get this:

    PS C:\> gwmi WIN32_LogonSession


AuthenticationPackage :
LogonId               : 179581975
LogonType             : 0
Name                  :
StartTime             : 16010101000000.000000-000
Status                :

    couple of minutes later, I could get this as below:

    PS C:\> gwmi WIN32_LogonSession


AuthenticationPackage : Negotiate
LogonId               : 179581975
LogonType             : 10
Name                  :
StartTime             : 20190916100123.425752-240
Status                :

AuthenticationPackage : NTLM
LogonId               : 180801663
LogonType             : 3
Name                  :
StartTime             : 20190916102527.426535-240
Status                :

    Tuesday, September 17, 2019 1:24 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    Thanks for your question.

    LogonType:

    0:Used only by the System account.

    RemoteInteractive(10): Terminal Services session that is both remote and interactive.

    https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-logonsession

    16010101000000.000000-000 was zero 

    https://devblogs.microsoft.com/oldnewthing/?p=18913

    Sorry, I still why you got the different results. 

    Best regards,

    Lee

                   

    Just do it.

    Wednesday, September 18, 2019 2:37 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    Was your issue resolved?

    If you resolved it using our solution, please "mark it as answer" to help other community members find the helpful reply quickly.

    If you resolve it using your own solution, please share your experience and solution here. It will be very beneficial for other community members who have similar questions.

    If no, please reply and tell us the current situation in order to provide further help.

    Best Regards,

    Lee

    Just do it.

    Friday, October 4, 2019 8:04 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Lee,

    The issue was not resolved.

    I didn't follow up as I don't know (didn't see) what the impact could be. If you can tell me what the impact could be, I will check further.

    Thanks.

    Friday, October 4, 2019 1:02 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    You may be picking up "stale" logon sessions. If you're looking for active logons, try using the Get-CimInstance -Class Win32_LoggedOnUser or Get-WMIObject Win32_LoggedOnUser. If you need any of the information from the WIN32_LogonSession can match the data with the information from the Win32_LoggedOnUser.

    --- Rich Matheisen MCSE&I, Exchange Ex-MVP (16 years)


    Friday, October 4, 2019 4:17 PM