none
gwmi (Get-WMIObject) get different results intermittently RRS feed

  • Question

  • I run gwmi on WIN2012R2, get different results as below. Don't know why? is it normal? Thanks!

    See the screen shots below. The PowerShell version is 4.0.

    Sometime I get this:

    PS C:\> gwmi WIN32_LogonSession
    
    
    AuthenticationPackage :
    LogonId               : 179581975
    LogonType             : 0
    Name                  :
    StartTime             : 16010101000000.000000-000
    Status                :

    couple of minutes later, I could get this as below:

    PS C:\> gwmi WIN32_LogonSession
    
    
    AuthenticationPackage : Negotiate
    LogonId               : 179581975
    LogonType             : 10
    Name                  :
    StartTime             : 20190916100123.425752-240
    Status                :
    
    AuthenticationPackage : NTLM
    LogonId               : 180801663
    LogonType             : 3
    Name                  :
    StartTime             : 20190916102527.426535-240
    Status                :

    Tuesday, September 17, 2019 1:24 PM

All replies

  • Hi,

    Thanks for your question.

    LogonType:

    0:Used only by the System account.

    RemoteInteractive(10): Terminal Services session that is both remote and interactive.

    https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-logonsession

    16010101000000.000000-000 was zero 

    https://devblogs.microsoft.com/oldnewthing/?p=18913

    Sorry, I still why you got the different results. 

    Best regards,

    Lee

                   


    Just do it.

    Wednesday, September 18, 2019 2:37 AM
    Moderator
  • Hi,

    Was your issue resolved?

    If you resolved it using our solution, please "mark it as answer" to help other community members find the helpful reply quickly.

    If you resolve it using your own solution, please share your experience and solution here. It will be very beneficial for other community members who have similar questions.

    If no, please reply and tell us the current situation in order to provide further help.

    Best Regards,

    Lee


    Just do it.

    Friday, October 4, 2019 8:04 AM
    Moderator
  • Hi Lee,

    The issue was not resolved.

    I didn't follow up as I don't know (didn't see) what the impact could be. If you can tell me what the impact could be, I will check further.

    Thanks.

    Friday, October 4, 2019 1:02 PM
  • You may be picking up "stale" logon sessions. If you're looking for active logons, try using the Get-CimInstance -Class Win32_LoggedOnUser or Get-WMIObject Win32_LoggedOnUser. If you need any of the information from the WIN32_LogonSession can match the data with the information from the Win32_LoggedOnUser.

    --- Rich Matheisen MCSE&I, Exchange Ex-MVP (16 years)


    Friday, October 4, 2019 4:17 PM