Finding at what time when a user disconnected

I’ve been looking at qwinsta and query session, but as far as I can see they don’t provide any time info.

I have several users remote accessing several development servers and not all of them are very good at remembering to sign out/log off their remote sessions when they are done - instead they disconnect.

I know that you can make Group Policies and other options that sign out people after a specific time period, but I would like to script it, so I can have exceptions depending on specific users and time since disconnect.

So if I could find the time when a user disconnected I could schedule a daily check that compares against the disconnect time and the users, and if everything fits, sign out the users (- which in turn triggers a series of other checks and commands). The only part that I’m missing is the time information . . .


you can try a ‘quser’ command, it shows ‘idle time’ on disconnected sessions

but it returns a text, not powershell object

Thanks Simeon,

Used your suggestion and then converted it to an object using:

(quser) -replace ‘\s{2,}’, ‘,’ | ConvertFrom-Csv

Only problem with that, is that when a user is disconnected the SESSIONNAME is blank, and the values moved “up one”:

USERNAME : >user1
SESSIONNAME : rdp-tcp#60
ID : 2
STATE : Active
LOGON TIME : 10-07-2015 15:10

USERNAME : user2
ID : Disc
STATE : 14:39
IDLE TIME : 22-07-2015 10:24

However, with some creative filtering I got around that :slight_smile:

I would start with the Terminal Services module.

Some of the times it will provide …

ConnectTime        : 8/13/2015 6:58:45 AM
CurrentTime        : 8/13/2015 8:13:13 AM
DisconnectTime     :
LastInputTime      : 8/13/2015 8:13:13 AM
LoginTime          : 8/13/2015 6:58:57 AM
IdleTime           : 00:00:00.0780035