none
WMI Script gives the complete list of all the remote users (logged off users also). I need only the current remote users.

    Question

  • Hi,

    I wanted to get all the current remote users of the supplied IP address of any machine.

    I have a WMI script for that as follows. However this script gives me the complete history of users, but I want to get the list of current users.

    Also, I would like to get like task manager/ user tab where I can find out ID (Eg. 1,2..) and status. The objSession.LogonId printing is a huge number as shown in the output.

    Script_________________________________________________________________________________

    strComputerIP = "xx.xxx.x.xxx" ' enter the ip of your remote machine
    strUser = "Administrator" ' enter admin user name
    strPassword = "123" 'enter admin password


    wbemImpersonationLevelImpersonate = 3
    wbemAuthenticationLevelPktPrivacy = 6

    Set objLocator = CreateObject("WbemScripting.SWbemLocator")
        Set objWMI = objLocator.ConnectServer _
            (strComputerIP, "root\cimv2", strUser, strPassword)
        objWMI.Security_.ImpersonationLevel = wbemImpersonationLevelImpersonate
        objWMI.Security_.AuthenticationLevel = wbemAuthenticationLevelPktPrivacy

    Set colOS = objWMI.InstancesOf ("Win32_OperatingSystem")'Get OS

    For Each objOS in colOS
        strName = objOS.Name
    Next

    If Instr(strName, "Windows 2000") > 0 Then 'For Windows 2000

        Set colComputer = objWMI.ExecQuery("Select * from Win32_ComputerSystem")
       
        For Each objComputer in colComputer
            Wscript.Echo "User: " & objComputer.UserName
        Next

    Else 'Windows XP or later
       Set colSessions = objWMI.ExecQuery _
              ("Select * from Win32_LogonSession Where LogonType = 10") 'Remote session
        WScript.Echo "Count of logons: " & colSessions.Count
        WScript.Echo "____________________________________"
               
        If colSessions.Count = 0 Then
            Wscript.Echo "No interactive user found"
        Else
            For Each objSession in colSessions
                Set colList = objWMI.ExecQuery("Associators of " _
                & "{Win32_LogonSession.LogonId=" & objSession.LogonId & "} " _
                & "Where AssocClass=Win32_LoggedOnUser Role=Dependent" )
                For Each objItem in colList
                    WScript.Echo "User: " & objItem.Name    
                                     WScript.Echo "LogonId: " & objSession.LogonId
                Next
                            WScript.Echo ""
            Next
        End If
    End If

    //End of script_______________________________________________________

    Output of this script is as follows. All the users listed in the output are not current users (logged off), so the result I am getting is not good to use.

    Count of logons: 4
    ____________________________________
    User: user
    LogonId: 1020485

    User: user1
    LogonId: 709651

    User: Administrator
    LogonId: 934069

    User: Administrator
    LogonId: 839367

    Thanks in advance,

    Jojo






    Tuesday, May 31, 2011 7:02 AM

Answers

  • A technique I came across to determine who was currently logged into a remote PC was to get the list of processes currently open, and then find who is running "explorer.exe". Like this:

    strComputer = InputBox("Name of the PC to check","PC Name",".")
    
    Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    Set colProcessList = objWMIService.ExecQuery("Select * from Win32_Process Where Name='explorer.exe'")
    
    For Each objProcess in colProcessList
      objProcess.GetOwner strNameOfUser, strUserDomain
      strOwner = strUserDomain & "\" & strNameOfUser
      WScript.Echo strOwner
    Next
    Tuesday, May 31, 2011 10:44 AM

All replies

  • Hello

    is there a speicific reason for making your own script?

     

    you can use the toosl called psLoogedOn from Sysinternals PsTools.

     

    http://technet.microsoft.com/en-us/sysinternals/bb896649

     

    it can give you´the currently logged onusers, it can even use a text file for compuitername, or ip ranges.

     

    but if you need it as a script, i can try take a look at your problem.


    Best Regards
    Jakob Gottlieb Svendsen
    Trainer/Consultant - Coretech A/S - Blog
    MCT - MCTS - VB.NET - C#.NET - Powershell - VBScript
    Tuesday, May 31, 2011 9:55 AM
    Moderator
  • Hi Jakob,

    Thanks very much for your reply. I am developing a utility to remotely connect to user machines, so suppose user machine itself is a remote desktop instance, then I have to prompt all the remote users connected to that machine in order to identify the required instance.

    The problem here is it is showing all the users which are connected and disconnected to this machine (Past and present). I need only the current existing users.

    It would be a huge help for me, if you can spare some time and resolve it.

    Thanks very much indeed,

    Best regards,

    Jojo



    Tuesday, May 31, 2011 10:28 AM
  • sure!

     

    i have tested on my systems, and i cannot even get the list.

     

    the call

    Version:0.9 StartHTML:00000107 EndHTML:00001298 EndFragment:00001258 EndFragment:00000000   Set colList = objWMI.ExecQuery("Associators of " _
                 & "{Win32_LogonSession.LogonId=" & objSession.LogonId & "} " _
                 & "Where AssocClass=Win32_LoggedOnUser Role=Dependant" )
    gives me no results.

     

    i dont know why atm, tested on 4 servers. i might get back to it, but i have to help my customers now :)

    good luck!


    Best Regards
    Jakob Gottlieb Svendsen
    Trainer/Consultant - Coretech A/S - Blog
    MCT - MCTS - VB.NET - C#.NET - Powershell - VBScript
    Tuesday, May 31, 2011 10:43 AM
    Moderator
  • A technique I came across to determine who was currently logged into a remote PC was to get the list of processes currently open, and then find who is running "explorer.exe". Like this:

    strComputer = InputBox("Name of the PC to check","PC Name",".")
    
    Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    Set colProcessList = objWMIService.ExecQuery("Select * from Win32_Process Where Name='explorer.exe'")
    
    For Each objProcess in colProcessList
      objProcess.GetOwner strNameOfUser, strUserDomain
      strOwner = strUserDomain & "\" & strNameOfUser
      WScript.Echo strOwner
    Next
    Tuesday, May 31, 2011 10:44 AM
  • Hi Richard,

    Well, this is a good solution to obtain the list of current users in a machine that has remote access sessions. However, my requirement is to get the session ID of all the remote user of a particular machine.I need information like windows task manager- user tab where I can find user, session ID and Session of each users.Once I get that session ID, then only I can connect to that session remotely. If you have any work around like user case, please suggest...

    Jakob,

    Hope you are getting "Count of logons" as some number. Please note that the LogonType = 10 is for remote users, so make sure that the computer you are testing should have some remote users.

    BR,

    Jojo

    Tuesday, May 31, 2011 4:38 PM
  • SessionID is a property of the Win32_Process object, so would something like this work for you:
    strComputer = InputBox("Name of the PC to check","PC Name",".")
    
    Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    Set colProcessList = objWMIService.ExecQuery("Select * from Win32_Process Where Name='explorer.exe'")
    WScript.Echo "User" & VBTab & "SessionID"
    WScript.Echo "====" & VBTab & "========="
    For Each objProcess in colProcessList
      objProcess.GetOwner strNameOfUser, strUserDomain
      strOwner = strUserDomain & "\" & strNameOfUser
      WScript.Echo strOwner & VBTab & objProcess.SessionID
    Next
    
    Tuesday, May 31, 2011 4:48 PM
  • Hi Richard,

    It is working fine. Thanks very much for your help.

    One final question I have, is there any way I can find out whether this session active or disconnected?

    Thanks once again,

    Best regards,

    Jojo


    Wednesday, June 1, 2011 4:22 AM
  • I use the following powershell script to invoke psloggedon from sysinternals.

     

    $Computer = Read-Host "Enter name of computer to check"
    
    $Results = $null
    $Results = PsLoggedon.exe -x -l \\$Computer | 
      Where-Object {$_ -match '^\s{2,}((?<domain>\w+)\\(?<user>\S+))'} |
      Select-Object @{ 
        Name = 'Computer' 
        Expression = {$Computer} 
      }, 
      @{ 
        Name = 'Domain' 
        Expression = {$matches.Domain} 
      }, 
      @{ 
        Name = 'User' 
        Expression = {$Matches.User} 
      }
    
    $Results | ft -auto
    

     

    I based this off the method Glenn Sizemore used to see if a computer was in use. See his post on the scripting guys blog here http://blogs.technet.com/b/heyscriptingguy/archive/2011/03/17/use-powershell-to-detect-if-a-workstation-is-in-use.aspx

    Wednesday, June 1, 2011 6:04 AM
  • What version of terminal serivces / windows server are you running?

     

     


    Best Regards
    Jakob Gottlieb Svendsen
    Trainer/Consultant - Coretech A/S - Blog
    MCT - MCTS - VB.NET - C#.NET - Powershell - VBScript
    Wednesday, June 1, 2011 12:13 PM
    Moderator
  • Hi Jakob,

    My test machine is windows 2003 server. Also I had  tested this in Win7 64 bit also. I hope the script will work on all the windows OSs.

    Cheers,

    Jojo


    Wednesday, June 1, 2011 4:31 PM
  • query user or quser will give you what you want. If you're using PowerShell, there's a module to get the information back in a PSObject:

    https://blog.vertigion.com/2018/07/22/quserobject/

    Tuesday, February 12, 2019 3:11 PM