check for a specific user logged in to terminal server

[dkurfurst]

I need to create a test that will do a check and return good and bad results for a specific user logged in on a terminal server. The server is Windows 2008. I need to be alerted when a particular user is no longer logged on to a particular terminal server.
anyone have any good way to test this ?
Thanks
Don

[KS-Soft Europe]

User accounts, currently logged in using Terminal Service connection can be checked using WMI. However WMI test will not be able to perform several WMI queries in order to retrieve user names.
You may use Shell Script test with custom made script instead.
E.g. Script may look like the following:

Code: Select all

On Error Resume Next

const statusAlive       = "scriptRes:Host is alive:"
const statusDead        = "scriptRes:No answer:"
const statusUnknown     = "scriptRes:Unknown:"
const statusNotResolved = "scriptRes:Unknown host:"
const statusOk          = "scriptRes:Ok:"
const statusBad         = "scriptRes:Bad:"
const statusBadContents = "scriptRes:Bad contents:"

dim i, objArgs, strComputer, strUser, strPsw, objSWbemLocator, objWMI, colSessions, colList

Set objArgs = WScript.Arguments

If objArgs.Count <> 4 Then
  WScript.StdOut.Write statusUnknown & "Required parameters: <IP/hostname> <Login Username> <Login Password> <Search Username>"
  WScript.Quit
End If

strComputer = objArgs(0)
strUser = objArgs(1)
strPsw = objArgs(2)

Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator")

If Err.Number <> 0 Then
  WScript.StdOut.Write statusUnknown & Err.Description
  WScript.Quit
End If

Set objWMI = objSWbemLocator.ConnectServer _
    (strComputer, "root\cimv2", strUser, strPsw)
If Err.Number <> 0 Then
  WScript.StdOut.Write statusUnknown & Err.Description
  WScript.Quit
End If


Set colSessions = objWMI.ExecQuery _ 
    ("Select * from Win32_LogonSession Where LogonType = 10") 

If colSessions.Count = 0 Then 
   WScript.StdOut.Write statusBad & "No remote users logged in"
   WScript.Quit
Else 

   For Each objSession in colSessions 
     Set colList = objWMI.ExecQuery("Associators of " _ 
         & "{Win32_LogonSession.LogonId=" & objSession.LogonId & "} " _ 
         & "Where AssocClass=Win32_LoggedOnUser Role=Dependent" ) 
     For Each objItem in colList 
       WScript.Echo "Username: " & objItem.Name & " FullName: " & objItem.FullName
       if objItem.Name = objArgs(3) Then
         WScript.StdOut.Write statusOk & objItem.FullName
         WScript.Quit
       End If
     Next
   Next 
End If

   WScript.StdOut.Write statusBad & "User " & objArgs(3) & " is not remotely logged in."

Start CMD: cmd /c cscript /B /E:VBScript %Script% %Params%

Script requires 4 parameters: <Terminal server IP/hostname> <Login Username> <Login Password> <Search Username>

Script will return Ok status if user is currently logged in using Terminal session.

[dkurfurst]

Thanks for the script. I set it up and I tested it by logging in the remote desktop session with the user I wanted to check and it did return the correct response. When I logged out and ran the script again against the same account it also came back as good. I ran the script manually from my desktop and entered all of the required parameters and its still showing that the session is connected when in fact it is not. I logged on locally to the system I want to check against and listed the remote desktop sessions and confirmed that the account I was testing for was NOT logged in.
Why would this keep reporting that the user is still connected when it is not?

[KS-Soft Europe]

There may be some delay. Windows WMI may see disconnected session as active during some period of time. Try to rerun test in 2-3 minutes.
As you can see script uses the following WMI query
Select * from Win32_LogonSession Where LogonType = 10

More information about Win32_LogonSession at:
http://msdn.microsoft.com/en-us/library ... s.85).aspx

[dkurfurst]

Unfortunately I tried several times during the day. I had tried several hrs after the account was logged out and it was still reporting 2 sessions as good.
Anything else I can try?

[KS-Soft Europe]

My be user just disconnected from Terminal Server, not logged off?
In such case script will detect that user is logged in and return status Ok.

[KS-Soft Europe]

If you need to check if rdp user session is currently active, you may try to use different script, based on quser utility.

Code: Select all

Option Explicit
On Error Resume Next

const statusUnknown     = "scriptRes:Unknown:"
const statusOk          = "scriptRes:Ok:"
const statusBad         = "scriptRes:Bad:"

dim ws, a, Str, objArgs, I, Server, Username, qUserPath

qUserPath = "D:\Utils\quser.exe"
Server = ""
Username = ""

Set objArgs = WScript.Arguments

If objArgs.Count < 1 Then
  WScript.StdOut.Write statusUnknown & "Expected one or two parameters: <username> [<Server>]"
  WScript.Quit
End If

Username = objArgs(0)

If objArgs.Count > 1 Then
  Server = " /SERVER:" & objArgs(1)
End If

Set ws = CreateObject("WScript.Shell")
Set a = ws.Exec(qUserPath & " " & Username & Server).StdOut

If Err.Number <> 0 Then
  WScript.StdOut.Write statusUnknown & "Can't start " & qUserPath & ". " & Err.Description
  WScript.Quit
End If

While Not a.AtEndOfStream
    Str = Str & Trim(a.ReadLine())
Wend

if InStr(Str,"rdp-") then
    WScript.StdOut.Write statusOk
  else
    WScript.StdOut.Write statusBad
end if

Start CMD: cmd /c cscript /B /E:VBScript %Script% %Params%

Script requires 1 or 2 parameters: <username> [<Server>]

Note1: quser utility may not be accessible for 32bit applications (like HostMonitor). In order to be able to use it, please copy it to non-system location (E.g. to D:\Utils\)
and modify script line qUserPath = "D:\Utils\quser.exe" to actual path on your system.
Note2: If script will return Bad Status, while user is logged in, you may check Quser utility output by running it in you cmd shell:
quser.exe UserName
or
quser.exe UserName /SERVER:ServerName

[dkurfurst]

Thanks for the updated script. I may have failed to mention that I want to check for a certain user that is logged in but it dosen't need to be active, in fact for the most part the account will be disconnected. The script in its current form only checks to see if there is an RDP session active and I need to just check if that user is logged in. I was able to modify the script and modified the following to look for the user account
...
if InStr(Str,"USER ACCOUNT NAME") then
WScript.StdOut.Write statusOk
else
WScript.StdOut.Write statusBad
end if

I am now getting "Good" Results if the user is logged in and active or if logged in and disconnected. I successfully get a "Bad: Notification if the user logs out.
Thanks for your assistance

Don

[KS-Soft Europe]

You are welcome!