How do I connect to another users remote desktop?

Another user connected to the remote computer Windows Issue on Remote

Hello,

We are currently in a very strange case where our users [Windows 20H2] connect via FortiClient to our infrastructure to access their PC remotely via RDP. Here some users have disconnections indicating that another user has logged in with their session.

Settings have been done like this:

Also by regrets we have withdrawn the UDP to be fully.

Even with this we have cuts knowing that these users are the only ones to use their workstation.

Do you have an idea about this ?

Thank you in advance.

Benjamin


windows-group-policyremote-desktop-client

2020-11-04-09-58-07-sent-items-benjamingrusson-lac.png [24.2 KiB]

Comment

Comment Show 0

Comment

5 |1600 characters needed characters left characters exceeded

  • Visible to all users
  • Visible to the original poster & Microsoft
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Visible to all users

Attachments: Up to 10 attachments [including images] can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KarlieWeng-MSFT answered Nov 10, '20

Hello Benjamin @BenjaminGrussonLacoste-7862

1.Does this happen to all the connections or specific user/group?

2.Desktop OS only supports one RDP connection at a time, be in physically local at the machine or remote session protocol. Is it possible there is an old connection still there, that didn't disconnect correctly?

You could check the Event Viewer Security logs [Windows Logs > Security]. It should log when someone/something logs into the computer.
Or
Event Viewer - Applications and Services Logs, Microsoft, Windows, TerminalServices-RemoteConnectionManager, Operational

3.Is it possible that two users are using the same username? or another person is mistakenly logging in.

4.Are they connecting to a VPN first? If so, it maybe be a timeout policy there.


If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best Regards
Karlie




Comment

Comment Show 0

Comment

5 |1600 characters needed characters left characters exceeded

  • Visible to all users
  • Visible to the original poster & Microsoft
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Visible to all users

Attachments: Up to 10 attachments [including images] can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

BenjaminGrussonLacoste-7862 answered Nov 10, '20 | KarlieWeng-MSFT edited Nov 11, '20

Hello Karlie,

Thank you for your answer.

  1. Only to a specific group actually. 5/6 out of 30 in remote. Strange things actually is that we have same setup for all PCs, Users, VPN configuration. So last impact might due to the internet connection of the user but here you might just get a message saying that RDP drop and attempting to reconnect. Unfortunately, you directly get something that make no sense for me where user has been disconnected by themselves.

  2. Good transition actually where user are only in remote. So that where it's hard to understand.

  3. Login are unique and known also by user.

  4. VPN looks fine from what we have. Moreover timeout disconnection are not occuring at all because VPN stay on the whole time + this situation is not generalized.

Here the Event of the security log. We have indeed a logoff but I'm not sure if it helps. Maybe you have a better picture on this than me.
[38688-event.xml][1]
Thank you in advance for your help.

Best,
Benjamin

Comment

Comment Show 0

Comment

5 |1600 characters needed characters left characters exceeded

  • Visible to all users
  • Visible to the original poster & Microsoft
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Visible to all users

Attachments: Up to 10 attachments [including images] can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

BenjaminGrussonLacoste-7862 answered Nov 10, '20

Karlie,

I managed to find something that could help on this but in the event log we have like 3 events that correspond to the disconnection and it happens always in the following:
- Event 4624: Logon of the PC it self [Ex: PC105 account name] with logon type = 5 with C:\Windows\System32\services.exe
- Event 4672: Special logon of the System account
- Event 4634: Logon off of the user with logon type = 3

From this link: //docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634, logon type 3 correspond to a Network title where "A user or computer logged on to this computer from the network." And to me the important element is computer where the computer connects to "itself" and disconnect the user. But still I'm not sure to get why the PC itself need to connect.

Hope I have something relevant that could help you.

Best,
Benjamin










Comment

Comment Show 0

Comment

5 |1600 characters needed characters left characters exceeded

  • Visible to all users
  • Visible to the original poster & Microsoft
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Visible to all users

Attachments: Up to 10 attachments [including images] can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KarlieWeng-MSFT answered Nov 11, '20

Hi Benjamin@BenjaminGrussonLacoste-7862

  1. Is the disconnection occurred when the user try to log on or during the remote session ?

  2. Is it possible that affected users have installed some third party software cause this problem , like this thread suggest.

  3. Under event 4624, can you identify who is logging [Windows user ID] in around the time users are being kicked out.

Administrator can run Enter-PSSession cmd from any pc from worksations to query the issued PC if there's still old connection.

Enter-PSSession

You could also try make below setting:


Keep me posted how it goes.

Thank you and have a great day!


If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best Regards
Karlie



image.png [320.5 KiB]

Comment

Comment Show 0

Comment

5 |1600 characters needed characters left characters exceeded

  • Visible to all users
  • Visible to the original poster & Microsoft
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Visible to all users

Attachments: Up to 10 attachments [including images] can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

BenjaminGrussonLacoste-7862 answered Nov 12, '20 | KarlieWeng-MSFT commented Nov 16, '20

Hello Karlie,

Thank you for your feedback.

  1. This happens during remote at a random time.

  2. User can't install third party software
    Here is the software installed

7-Zip 18.05 [x64]
Adobe Acrobat 8 Professional - English, Français, Deutsch
Adobe Acrobat Reader DC
Belarc Advisor 8.5a
Citrix Receiver 4.12
Dell Command | Update
DesktopControl
ESET Endpoint Antivirus
ESET Management Agent
Google Chrome
Greenshot 1.2.10.6
Intel[R] Management Engine Components
Intel[R] Network Connections Drivers
Intel[R] Processor Graphics
Intel[R] Rapid Storage Technology
Intel[R] Wireless Bluetooth[R]
Intel® PROSet/Wireless Software
Java 8 Update 181
Java 8 Update 181 [64-bit]
Java SE Development Kit 8 Update 181
KeePass Password Safe 2.40
LGT Class E-Banking CH
Logitech Options
MariaDB ODBC Driver
Microsoft 365 Apps for business - en-us
Microsoft Edge
Microsoft Edge Update
Microsoft OneDrive
Microsoft OneDrive
Microsoft Silverlight
Microsoft Teams
Microsoft Teams
Microsoft Update Health Tools
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Visual C++ 2013 Redistributable [x86] - 12.0.30501
Microsoft Visual C++ 2015 Redistributable [x64] - 14.0.23026
Microsoft Visual Studio 2010 Tools for Office Runtime [x64]
Mozilla Firefox 63.0.3 [x64 en-US]
MySQL Connector/ODBC 5.3
MySQL Workbench 6.3 CE
Notepad++ [32-bit x86]
PuTTY release 0.70 [64-bit]
Realtek Audio COM Components
Realtek High Definition Audio Driver
Rocket.Chat 3.0.2
Skype version 8.63
Teams Machine-Wide Installer
Update for Windows 10 for x64-based Systems [KB4023057]
VLC media player
Windows 10 Update Assistant
WinSCP 5.17.7
Zoom

  1. Here on the Users Account, only the user assigned to the PC can loggin

Thank you for your help.

Best,
Benjamin



Comment

Comment · Show 1

Comment

5 |1600 characters needed characters left characters exceeded

  • Visible to all users
  • Visible to the original poster & Microsoft
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Visible to all users

Attachments: Up to 10 attachments [including images] can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KarlieWeng-MSFT · Nov 16, 2020 at 07:03 AM

hi Benjamin

Here are some related workarounds you may try:

//theitbros.com/win-server-2008-multiple-rdp-sessions/
//serverfault.com/questions/847624/suppress-message-your-remote-desktop-services-session-has-ended

I hope this will help!

[Note: This is a third-party link and we do not have any guarantees on this website. And Microsoft does not make any guarantees about the content.]

Best Regards
Karlie

0 Votes 0 ·

BenjaminGrussonLacoste-7862 answered Nov 16, '20 | KarlieWeng-MSFT commented Nov 18, '20

Hi Karlie,

Currently one of the user is on the PC105. Regarding your links, the first fSingleSessionClient registry key is at 1 and the rest of the Local Group Policy was already set like the link.
So as a test, we switched this user to another PC [PC128 and no issue, smooth rdp session] and strange fact, registry key fSingleSessionPerUser is at 1 too and Policy are not even set. So I'm not sure if these are the key to this.

Another thing is that when we saw logoff event from the viewer in PC105 [c.f attached here], we see that logon from PC105 is done with several services launched [services.exe or svchost.exe] which directly cause the logoff of the user. Here these type of event never appears on PC128 [where the user is not disconnected]. Is there a way to disable these event to occur because it looks like it might be our solution.

[40058-failevent.xml][1]
[40065-failevent2.xml][2]
Thank you for your help.

Best,
Benjamin

Comment

Comment · Show 1

Comment

5 |1600 characters needed characters left characters exceeded

  • Visible to all users
  • Visible to the original poster & Microsoft
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Visible to all users

Attachments: Up to 10 attachments [including images] can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KarlieWeng-MSFT · Nov 18, 2020 at 02:45 AM

Hey Benjamin,

I think you may need to use process monitor to confirm which program or services caused this logoff.

Note not to leave private information here.

Keep me posted how it goes. Thank you and have a great day!


Thank you
Karlie

0 Votes 0 ·

BenjaminGrussonLacoste-7862 answered Nov 18, '20 | KarlieWeng-MSFT commented Nov 18, '20

Hello Karlie,

Thank you for this tools actually. It looks fantastic.
Actually at this point, how to know which process might cause the logoff and for what reason ? Can you please give me more details on how to use this tool ?

Thank you for your help.

Best,
Benjamin

Comment

Comment · Show 1

Comment

5 |1600 characters needed characters left characters exceeded

  • Visible to all users
  • Visible to the original poster & Microsoft
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Visible to all users

Attachments: Up to 10 attachments [including images] can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KarlieWeng-MSFT · Nov 18, 2020 at 09:21 AM


a.Open Process Monitor, Press “Ctrl+E”, then press “Ctrl+X” to clean the current data. 
b. Press “Ctrl+E” to start process monitor
c. Reproduce the issue
d. After entering “command” in search box without search result, press “Ctrl+E”  to stop tracing, and press “Ctrl+S” to save the log.
e. Select “All Events” and in PML format when saving.
f. please note the detail time of clicking on startmenu


Then you need to read from PML file, there will be a lot of process recorded [thousands], and this take quite long time to find out which one caused this problem.

0 Votes 0 ·

BenjaminGrussonLacoste-7862 answered Nov 18, '20

Hello Karlie,

I managed to get a user disconnection message but to be frank, I don't where and what to search for. Can I give you the saved log so you can take a look ?
Maybe actually do you what is the process that initiate the logoff of the user ?

Thank you in advance for your help.

Best,
Benjamin

Comment

Comment Show 0

Comment

5 |1600 characters needed characters left characters exceeded

  • Visible to all users
  • Visible to the original poster & Microsoft
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Visible to all users

Attachments: Up to 10 attachments [including images] can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

BenjaminGrussonLacoste-7862 answered Nov 23, '20

Hello Karlie,

Do you have any update for me ?

Thank you in advance for your help.

Best,
Benjamin

Comment

Comment Show 0

Comment

5 |1600 characters needed characters left characters exceeded

  • Visible to all users
  • Visible to the original poster & Microsoft
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Visible to all users

Attachments: Up to 10 attachments [including images] can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

BenjaminGrussonLacoste-7862 answered Nov 26, '20

Hello Karlie,

I'm getting back to you where I'm not finding anything relevant to me at this point.

Do you have any input for me ?

Thank you in advance for your help.

Best,
Benjamin

Comment

Comment Show 0

Comment

5 |1600 characters needed characters left characters exceeded

  • Visible to all users
  • Visible to the original poster & Microsoft
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Visible to all users

Attachments: Up to 10 attachments [including images] can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

How To Set Up Multiple Remote Desktop Connections

RDP Wrapper: Enabling Multiple RDP Sessions on Windows 10

One option to enable remote desktop for multiple users on Windows 10 is by using the RDP Wrapper Library. The RDP Wrapper project permits users to support more than one simultaneous RDP session on Windows 10 [without replacing the termsrv.dll file].

RDP Wrapper acts as a layer between the Remote Desktop Service, and Service Control Manager [SCM]. RDPWrap lets users enable support for multiple simultaneous RDP sessions, as well as enabling support of RDP Hosts on previously inaccessible Windows 10 versions, like Home.

This app doesn’t alter the termsrv.dll file, only loading the “termsrv” library with the altered parameters necessary for simultaneous connection. Meaning, RDPWrap will even work if the termsrv.dll file updates, meaning that users don’t have to dread Windows updates.

Please note: Prior to the installation of the RDP Wrapper library, users must ensure they’re using the original [unpatched] version of the “termsrv.dll” file. If they don’t use the unpatched file, the app may not function properly or won’t function at all.

Users can download RDP Wrapper from the GitHub Repository [v1.6.2 is the latest available version of RDP Wrapper Library].

According to the information on the developer page, all versions of Windows are supported [Windows 10 support is available up to the 1809 build].

Users will find the following files contained within the RDPWrap-v1.6.2.zip archive:

  • • RDPWinst.exe [RDP Wrapper Library installation/uninstallation program].
  • • RDPConf.exe [RDP Wrapper configuration utility].
  • • RDPCheck.exe [Local RDP Checker, RDP check utility].
  • • install.bat, uninstall.bat, update.bat [batch files for install, uninstall, and updates for RDP Wrapper].

Run the install.bat with the Administrator privileges to install RDPWrap. The utility will access the GitHub site for the most recent versions of the “ini” file during the installation.

RDP Wrap will be installed in the C:\Program Files\RDP Wrapper directory.

Once installation is complete, users should run the RDPConfig.exe.

In the “Diagnostics” section, ensure all elements are green [see below].

Run the RDPCheck.exe, then attempt to start a secondary RDP session [or connect multiple RDP sessions from remote computers].

That’s it! Now the Windows 10 machine should permit multiple users to access different RDP sessions simultaneously.

All Windows editions [Windows 7, Windows 8.1, and Windows 10] are supported by the RDPWrap utility. Meaning that users can establish a terminal [RDS] server on any desktop instance of Windows.

Additional noteworthy RDP Wrapper features:

  • • The “Hide users on logon screen” option allows administrators to conceal user lists from the Windows Logon Screen.
  • • If users disable the “Single session per user” option, more than one simultaneous RDP session will work under the same user account [the registry parameter “fSingleSessionPerUser = 0” is set under the key “HKLM\SYSTEM\ CurrentControlSet\Control\Terminal Server\fSingleSessionPerUser”].
  • • Users can edit the Remote Desktop port number from 3389 to a different number of their choosing.
  • • The “Session Shadowing Mode” section lets users reconfigure the remote control [shadow] connection permissions to Windows 10 RDP sessions.

25 Replies

· · ·

Pure Capsaicin

OP

DragonsRule

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

Mar 28, 2018 at 19:53 UTC

Microsoft Remote Desktop Services expert

102 Best Answers

340 Helpful Votes

Windows 10 [along with all MS Desktop OS] is licensed for single user access. There is no license to allow multiple sessions. For that you need Server and RDS licenses.

5

· · ·

Pure Capsaicin

OP

DragonsRule

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

Mar 28, 2018 at 19:54 UTC

Microsoft Remote Desktop Services expert

102 Best Answers

340 Helpful Votes

Maybe there's an alternative method to what you need to do? Why do they need to control this PC?

0

· · ·

Thai Pepper

OP

MbrownTechSol

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

Mar 28, 2018 at 20:35 UTC

Just echoing what Dragonsrule said. Desktops can't run more than 1 user instance at a time. if it was MS server? then it would be different and you could add remote access licenses.

0

· · ·

Cayenne

OP

ScottM1979

This person is a verified professional.

Mar 28, 2018 at 20:44 UTC

Reiterating whatDragonsRulesaid. For multiple users to connect to the same system, you will need to run a server OS with RDS enabled [requires additional licensing]. Otherwise, you should run a separate PC per user to remote into. 

  • DragonsRule

    Pure Capsaicin

0

· · ·

Jalapeno

OP

Crotech Mar 28, 2018 at 21:09 UTC

I do have Server and RDS license for this function.

0

· · ·

Pure Capsaicin

OP

DragonsRule

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

Mar 28, 2018 at 21:10 UTC

Microsoft Remote Desktop Services expert

102 Best Answers

340 Helpful Votes

Crotech wrote:

I do have Server and RDS license for this function.

Ok, then why the mention of Windows 10?

1

· · ·

Cayenne

OP

ScottM1979

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

Mar 28, 2018 at 21:23 UTC

Square peg, round hole. Don't try to make Windows 10 do something it's not intended to do. The server OS and RDS licenses give you the ability to do what you want.

0

· · ·

Jalapeno

OP

Crotech Mar 28, 2018 at 21:49 UTC

I'm mentioning Windows 10 because the 3 people are connecting to a windows 10 machine.

1

· · ·

Pure Capsaicin

OP

DragonsRule

This person is a verified professional.

Mar 28, 2018 at 22:02 UTC

Microsoft Remote Desktop Services expert

102 Best Answers

340 Helpful Votes

Crotech wrote:

I'm mentioning Windows 10 because the 3 people are connecting to a windows 10 machine.

Oh, I see - that's how it's currently setup. Got it.

So, what I'd suggest is setting up your Server with RDS [if it's not already] then installing whatever the app is they need, then either letting them RDP into it or configuring RemoteApp.

0

· · ·

Jalapeno

OP

Crotech Mar 28, 2018 at 22:03 UTC

DragonsRule,

Thank you sir. I do have the RDS server setup, that makes sense.

1

· · ·

Jalapeno

OP

Crotech Mar 28, 2018 at 22:58 UTC

Sorry i thought this solved my problem. So i have a domain controller which has RD server install on it. The server I will have users log into is on the same domain. How can I allow 3 users to connect to that server?

0

· · ·

Thai Pepper

OP

Lockout Mar 28, 2018 at 23:42 UTC

You will need to have CALs installed in order to have remote connection to the server. Maybe someone else can verify as it has been some time since I have needed to configure a terminal server. The user accounts will also need to be added to a local group on the Terminal server that have permissions necessary to use Remote Desktop

0

· · ·

Jalapeno

OP

Crotech Mar 28, 2018 at 23:44 UTC

I have 50 cals available so that isn't the problem. I am having a hard time knowing where to go and configure these settings...

0

· · ·

Pure Capsaicin

OP

DragonsRule

This person is a verified professional.

Mar 29, 2018 at 00:12 UTC

Microsoft Remote Desktop Services expert

102 Best Answers

340 Helpful Votes

Crotech wrote:

Sorry i thought this solved my problem. So i have a domain controller which has RD server install on it. The server I will have users log into is on the same domain. How can I allow 3 users to connect to that server?

Is this what you are looking for?

//docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-deploy-infrastruc...

0

· · ·

Pure Capsaicin

OP

DragonsRule

This person is a verified professional.

Mar 29, 2018 at 00:13 UTC

Microsoft Remote Desktop Services expert

102 Best Answers

340 Helpful Votes

Crotech wrote:

I have 50 cals available so that isn't the problem. I am having a hard time knowing where to go and configure these settings...

You have 50 RDS CALs, but haven't been using them? Can I ask why?

0

· · ·

Jalapeno

OP

Crotech Mar 29, 2018 at 00:17 UTC

This is more what I'm trying to accomplish:

//social.technet.microsoft.com/Forums/lync/en-US/49c71416-e679-4065-aebc-b769bd85edda/windows-...

0

· · ·

Habanero

OP

John4120

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

Mar 29, 2018 at 00:45 UTC

You could also look at other options like TightVNC or something else along those lines. The catch to that would be that everyone would use one common logon to that machine instead of their own.

0

· · ·

Pure Capsaicin

OP

Best Answer

DragonsRule

This person is a verified professional.

Mar 29, 2018 at 01:02 UTC

Microsoft Remote Desktop Services expert

102 Best Answers

340 Helpful Votes

Crotech wrote:

This is more what I'm trying to accomplish:

//social.technet.microsoft.com/Forums/lync/en-US/49c71416-e679-4065-aebc-b769bd85edda/windows-...

Once RDS is up and running your users just RDP into the Server and login. That's all.

Unless you want to use RemoteApp, which involves a few more steps. I wrote a short article about RemoteApp a while back:

//community.spiceworks.com/topic/1988598-remoteapp-remote-access-tool-to-simplify-a-sysadmin-l...

0

· · ·

Pure Capsaicin

OP

DragonsRule

This person is a verified professional.

Mar 29, 2018 at 01:03 UTC

Microsoft Remote Desktop Services expert

102 Best Answers

340 Helpful Votes

John4120 wrote:

You could also look at other options like TightVNC or something else along those lines. The catch to that would be that everyone would use one common logon to that machine instead of their own.

That won't allow multiple people to access the machine at the same time, which is OP's main goal.

1

· · ·

Cayenne

OP

Josh_the_Geek

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

Mar 29, 2018 at 02:27 UTC

This will solve your problem, works just fine for me, although it violates the terms and conditions and if you are in a production environment, and you get audited, you might have a bad time.

//www.serverwatch.com/server-tutorials/how-to-enable-concurrent-remote-desktop-sessions-in-win....

otherwise just set up RDS on a server in the same domain and buy some CALs.

0

· · ·

Pure Capsaicin

OP

DragonsRule

This person is a verified professional.

Mar 29, 2018 at 10:55 UTC

Microsoft Remote Desktop Services expert

102 Best Answers

340 Helpful Votes

Josh_the_Geek wrote:

This will solve your problem, works just fine for me, although it violates the terms and conditions

This is an IT Pro forum, so we try not to show people how to violate licensing.

1

· · ·

Chipotle

OP

Giridhara [Zoho]

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

Mar 30, 2018 at 14:41 UTC

Brand Representative for Zoho

Hey AJ,

Desktop Central will help. Give a try. Comes free for 50 endpoints.

Let me know if you need a demo of the same.

Cheers!

  • Desktop Central[49]

  • Crotech

    Jalapeno

0

· · ·

Cayenne

OP

Josh_the_Geek

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

Mar 31, 2018 at 02:32 UTC

DragonsRule wrote:

Josh_the_Geek wrote:

This will solve your problem, works just fine for me, although it violates the terms and conditions

This is an IT Pro forum, so we try not to show people how to violate licensing.

It only really violateslicensing in production environments.

0

· · ·

Pure Capsaicin

OP

DragonsRule

This person is a verified professional.

Mar 31, 2018 at 11:54 UTC

Microsoft Remote Desktop Services expert

102 Best Answers

340 Helpful Votes

Josh_the_Geek wrote:

DragonsRule wrote:

Josh_the_Geek wrote:

This will solve your problem, works just fine for me, although it violates the terms and conditions

This is an IT Pro forum, so we try not to show people how to violate licensing.

It only really violateslicensing in production environments.

How do you figure that? It's against the MS licensing to do it. I've not seen anything saying it's okay to do while testing, but I certainly haven't read every MS released document :]

Can you provide a link to something from MS saying it's okay in non production?

0

  • prev
  • 1
  • 2
  • next

This topic has been locked by an administrator and is no longer open for commenting.

To continue this discussion, please ask a new question.

How to view list of active remote desktop Users in Windows Server ?

👤 Diwas Poudel 🕒 Jan 26 2022 📁 Fix 📜 0 comment

If you're curious about who is currently connected to a remote desktop connection, you've come to the right place. There are numerous methods for determining the number of remotely connected users.

RDP, which stands for Remote Desktop Protocol, is a protocol developed and owned by Microsoft that allows a user to connect to another computer via a network connection using a graphical interface. To connect to the server, the user uses RDP client software, whereas the server uses RDP server software, which is included with the Windows Server operating system. When a client connects to a server, Windows Servers keep track of the logged-in user's information, which we can view.

So let's get started.

Using Task Manager

Using Task Manager, we can see a list of active remote desktop users on a Windows server. This method of checking Active User works for every version of Windows Server.
Here are the steps:

  1. Goto Run and type taskmgr.exe and press the Ok button
    This will open Task Manager.
  2. Just navigate to the Users tab there you will get Users currently active.

It will display a list of users currently logged in. Here, I have only logged so it is showing one user information. Also, it contains information like what application the user is using, its current status, CPU usage, and memory usage.

Here you will only be able to determine which users are using Remote Connection. If you want to know which types of connections are used to connect to the remote, simply click on any column of the list, say "Status," then right-click on it and select "Session." The list will then show a session column with the types of connections to remote, such as console, terminal, services, or RDP, and so on. As shown below.

Using Query User Command

With the help of the query command, we can find various information about sessionId, the number of users, session state[active/inactive] etc on the Remote Desktop Session Host Server. This command can be used to determine whether a specific user is logged in to a specific Remote Desktop Session Host Server or not.

This command will work Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, etc. So, this command will not work for Windows Server 2008.

Syntax:

query user [ | | ] [/server:]

Example:

It will return the following information:

Note: You must have Full Control Authorization or special access permission to use this command.

query session

It displays information about not only active sessions but also other sessions that the server is running.

Using quser command

This is the same as the Query User command. This command will also work for Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012 only.

Syntax

quser [ | | ] [/server:]

Using qwinsta command

Query WINdows STAtion is abbreviated as qwinsta. It displays information about sessions on a Remote Desktop Session Host server. The list includes information not only about active sessions but also about other sessions that the server runs.

Syntax

qwinsta [ | | ] [/server:] [/mode] [/flow] [/connect] [/counter]

Example:

Look at the state column and you will see whether the user is active or not. You can see here User with ID 6 is active

Also Read: Debug IIS hosted web application in visual studio

Using Get-RDUserSession commandlet

The Get-RDUserSession cmdlet returns a list of all user sessions in a collection or in a Remote Desktop deployment. Note that this may not work in some servers like Windows R2 2012.

Import-Module RemoteDesktop Get-RDUserSession

Output:

Using WMI

Windows Management Instrumentation [WMI] is a PowerShell subsystem that provides administrators with powerful system monitoring tools.

By simply typing the following command you will know a lot:

Get-WmiObject Win32_LoggedOnUser

If you just want to know the username just type the below command:

Get-WmiObject Win32_LoggedOnUser | Select Antecedent -Unique | %{"{0}\{1}" -f $_.Antecedent.ToString[].Split['"'][1],$_.Antecedent.ToString[].Split['"'][3]}

Using PsLoggedOn Tools

PsTools is a small Sysinternals command-line tool that can help in the administration of local and remote systems. It aids to determine currently logged-in users in local as well as remote systems.

Because PsLoggedOn requires a logon to access the Registry of a remote system, it will show you as logged on via resource share to remote computers that you query.

Note that this tool's command will only work for Windows Server 2008 and above.

Syntax:

psloggedon [- ] [-l] [-x] [\\computername | username]

Here,

ParameterDescription
-Displays the supported options as well as the units of measurement for output values.
-lDisplays only local logins rather than both local and network resource logons.
-xDon't Show Logon times.
computernameSpecifies the name of the compute for which logon information is to be displayed.
usernamePsLoggedOn searches the network for computers where that user is logged in if you specify a user name. This is useful if you don't want a specific user to be logged in when you're about to change their user profile configuration.

Download

Also Read: Why Windows OS is popular?

Steps to use PsLogged.

PSLoggedOn requires the Remote Registry Service to be running on the target computer. This service is not enabled by default.

Using Remote Event Viewer

Event Viewer is a powerful Windows tool that allows you to obtain log information from both your local and remote computers.

1 Connect successfully to a remote computer

2 Press Ctrl + R and type eventvwr and press Enter. This will open eventvwr.

3 Just click on the 'Create Custom View' label located at the right corner.

4 Then under Popup, select Security under 'Event Logs' and type Id in as 4624 ,4647, 4779,4800 and then press Ok.

5 In the next screen give the Name of the log like 'Remote Login History' and click on Ok.

6 You will get the 'Remote Login History' Label under Custom Views. Click on the label 'Remote Login History' you will get all login, logout, locked, unlocked event information of the remote users.

7Click on the row of the event and detail related to that event will get displayed just below it.

How to Enable Remote Registry Service in Remote Server?

Steps for enabling remote registry service in remote server as follows:

Or you can simply run following line by line in Powershell.

Set-Service RemoteRegistry –startuptype automatic –passthru
Start-Service RemoteRegistry

Set-Service is the cmdlet that can modify the StartupType, Status, Description, and Displayname properties of a service. You can start, stop, and suspend service with the help of the Set-Service cmdlet.

Here, Set-Service is looking for RemoteRegistry Service and set this service to start automatically. And -passthru indicates that if you are already running this service then ignore it else runs it automatically.

Powershell Script File which displays List of all User RDP connection

The below script will list all users' RDP Connections History.

Steps:

Scripts:

$AllUser = Get-WmiObject -Class Win32_UserAccount
foreach[$User in $AllUser]
{
$RegPath = "Registry::HKEY_USERS\"+$User.SID+"\Software\Microsoft\Terminal Server Client\Servers\"
Write-Host "User:"$User.Name
Write-Host "SID:"$User.SID
Write-Host "Status:"$User.Status
$QueryPath = dir $RegPath -Name -ErrorAction SilentlyContinue
If[!$?]
{
Write-Host "[!]Not logged in"
Write-Host "[*]Try to load Hive"
$File = "C:\Documents and Settings\"+$User.Name+"\NTUSER.DAT"
$Path = "HKEY_USERS\"+$User.SID
Write-Host "[+]Path:"$Path
Write-Host "[+]File:"$File
Reg load $Path $File
If[!$?]
{
Write-Host "[!]Fail to load Hive"
Write-Host "[!]No RDP Connections History"
}
Else
{
$QueryPath = dir $RegPath -Name -ErrorAction SilentlyContinue
If[!$?]
{
Write-Host "[!]No RDP Connections History"
}
Else
{
foreach[$Name in $QueryPath]
{
$User = [Get-ItemProperty -Path $RegPath$Name -ErrorAction Stop].UsernameHint
Write-Host "Server:"$Name
Write-Host "User:"$User
}
}
Write-Host "[*]Try to unload Hive"
Start-Process powershell.exe -WindowStyle Hidden -ArgumentList "Reg unload $Path"
}
}
foreach[$Name in $QueryPath]
{
Try
{
$User = [Get-ItemProperty -Path $RegPath$Name -ErrorAction Stop].UsernameHint
Write-Host "Server:"$Name
Write-Host "User:"$User
}
Catch
{
Write-Host "[!]No RDP Connections History"
}
}
Write-Host "----------------------------------"
}

Script Credits goes to gstudent@3gstudent

What is happening in the above script?

Ans: To begin, use "reg load" to load the hive. Then, from "HKEY_USERS\"+$User.SID+"\Software\Microsoft\Terminal Server Client\Servers\", read the RDP Connections History.Finally, use "reg unload" to unload the hive. To get the history of login users, data are read from NTUSER.DAT file

report this ad

Video liên quan

Bài Viết Liên Quan

Toplist mới

Bài mới nhất

Chủ Đề