The existing [who] section uses qwinsta.exe which seems to be installed on most Windows builds by default.
For servers (2003, 2008), qusers.exe provides additional information, particularly idle and logon time. I like to monitor long-term RDP connections on systems with limited remote logons (default limit is 2).
Can a section [users] be added which includes the output of 'query user' if it is available on the system? If not, the section should be skipped (no [users] header at all).
PS C:\> qwinsta.exe
SESSIONNAME USERNAME ID STATE TYPE DEVICE
services 0 Disc
rdp-tcp#2 admin1 1 Active rdpwd
rdp-tcp#0 admin2 2 Active rdpwd
rdp-tcp#1 admin3 3 Active rdpwd
console 4 Conn
>rdp-tcp#3 admin4 5 Active rdpwd
rdp-tcp 65536 Listen
PS C:\> query user
USERNAME SESSIONNAME ID STATE IDLE TIME LOGON TIME
admin1 rdp-tcp#2 1 Active 30 2/12/2011 8:58 AM
admin2 rdp-tcp#0 2 Active 16 5/12/2011 11:00 AM
admin3 rdp-tcp#1 3 Active 49 5/12/2011 9:23 AM
>admin4 rdp-tcp#3 5 Active . 5/12/2011 11:50 AM
Log in to post a comment.