{"id":13731,"date":"2011-06-04T00:01:00","date_gmt":"2011-06-04T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2011\/06\/04\/use-powershell-to-find-logon-sessions\/"},"modified":"2011-06-04T00:01:00","modified_gmt":"2011-06-04T00:01:00","slug":"use-powershell-to-find-logon-sessions","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/use-powershell-to-find-logon-sessions\/","title":{"rendered":"Use PowerShell to Find Logon Sessions"},"content":{"rendered":"

Summary<\/b>: Learn how to use Windows PowerShell to discover logon session information for remote computers.\nMicrosoft Scripting Guy, Ed Wilson, here. This week we will have one guest blogger for the entire week. Sean Kearney has written a series of blog posts about Windows PowerShell and the Legacy. I am not going to be redundant by reposting his biography<\/a> each and every day.\nHere’s Sean…\nHere’s a problem I get daily. I need to access a machine because somebody calls complaining about a problem. Most of the time, I can figure out the problem based on the person’s name and their machine name. But sometimes, well…“Things ain’t just the way ya like ‘em.”\nI gave up trying to look at the sessions in computer management. In a larger environment, that’s about as slow as a hamster-powered sports car.\nSo I went back to the basics and found my old friend NET.EXE—see it on a file server? It already has the answer. Problem is, it contains nothing but IP addresses, and I hate navigating that output.  FIND.EXE is good, but it has limitations too!\nSo I turned to Windows PowerShell to help me out. Combining Windows PowerShell remoting along with some legacy apps gave me a really cool solution.\nFirst, to see what it looks like, I ran the following script in Windows PowerShell.<\/p>\n

\n

(NET SESSION)<\/span><\/span><\/span><\/p>\n<\/blockquote>\n

This showed me all the open sessions on my file server where most of the users home drives were located. (Your environment may be different, so I recommend picking the machine with a file share that most of the users in your environment are likely to attach to.)\nThen to quickly find the user, I piped the output as follows.<\/p>\n

\n

SELECT-STRING<\/span><\/span><\/span><\/p>\n

(NET SESSION) | Select-String mr.trouble<\/span><\/span><\/span><\/p>\n<\/blockquote>\n

 <\/em> <\/i>\nNow to get fancy, I decided to see if I could pass this into the file server via a remote session to allow this to be run from any system.<\/p>\n

\n

$S=NEW-PSSESSION –computername MYFILESERVER<\/span><\/span><\/span><\/p>\n

INVOKE-COMMAND –Session $s –scriptblock { (NET SESSION) | Select-String mr.trouble }<\/span><\/span><\/span><\/p>\n

REMOVE-PSSESSION $S<\/span><\/span><\/span><\/p>\n<\/blockquote>\n

<\/em><\/i>\nNow at the very least, I could see a much shorter list and resolve those IP addresses to computer names as follows.<\/p>\n

\n

nslookup x.x.x.x<\/span><\/span><\/span><\/p>\n<\/blockquote>\n

But wait.  Don’t I want all of this as a single function?  Don’t I want to make my life easier? What a concept!<\/em>\nI found a small problem in getting the variable to be received by the remote session, so yes…I cheated. I piped after.  I’ll probably look at this later and find the right answer vs. the “cheaters answer.” <\/p>\n

\n

function global:FIND-HSGUSER {<\/span><\/span><\/span><\/p>\n

# Get name of File Server to Initialize Remoting <\/span><\/span><\/span>
<\/span><\/span># and the name of the silly user you need to find their computer for    <\/span><\/span><\/span><\/p>\n

param($FILESERVER,$USERNAME)<\/span><\/span><\/span><\/p>\n

# Connect Remotely to Server, Run Session, get a list of everybody logged in there<\/span><\/span><\/span> <\/p>\n

    $S=NEW-PSSESSION –computername $FILESERVER<\/span>
    $Results=(INVOKE-COMMAND –Session $s –scriptblock { (NET SESSION) }) | Select-string $USERNAME<\/span>
<\/span><\/span>    REMOVE-PSSESSION $S<\/span><\/span><\/span><\/p>\n

# Let’s parse through the data and pull out what we need    <\/span><\/span><\/span><\/p>\n

Foreach ( $Part in $RESULTS ) {<\/span><\/span><\/span><\/p>\n

    $ComputerIP=$Part.Line.substring(2,21).trim()<\/span><\/span><\/span>
<\/span><\/span>    $User=$Part.Line.substring(22,44).trim()<\/span><\/span><\/span><\/p>\n

# Use nslookup to identify the computer, grab the line with the “Name:” field in it<\/span><\/span><\/span><\/p>\n

    $Computername=(nslookup $ComputerIP | Where { $_ -like ‘Name:’})<\/span><\/span><\/span><\/p>\n

    If ($Computername -eq $NULL) { $Computername=”Unknown”}<\/span><\/span><\/span>
<\/span><\/span>    Else { $Computername=$Computername.substring(9).trim()}<\/span><\/span><\/span><\/p>\n

    write-host<\/span><\/span><\/span>
<\/span><\/span># Show me where the silly fool is hiding<\/span><\/span><\/span><\/p>\n

“$User is logged into $Computername with IP address $ComputerIP”<\/span><\/span><\/span><\/p>\n

}<\/span><\/span><\/span><\/p>\n

}<\/span><\/span><\/span><\/p>\n<\/blockquote>\n

Of course this is a far from a perfect solution. I have found that if the IP address isn’t registered in DNS, it pops out an irritating line that bypasses the console output. But it does show a nice way to make life a little easier on the Administrator with Windows PowerShell and the Legacy.\nTake it, use it, abuse it, get creative, and see what YOU can do with existing legacy tools. It’s not “taboo,” it’s power to leverage!\n“Legacy rules”…and the Power of Shell too.\nGuest blogger week will continue tomorrow when Sean will continue to talk about Windows PowerShell and the Legacy. A special thank you to Sean for writing this week’s blog posts. Hope you enjoy them.\nI invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/b><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Learn how to use Windows PowerShell to discover logon session information for remote computers. Microsoft Scripting Guy, Ed Wilson, here. This week we will have one guest blogger for the entire week. Sean Kearney has written a series of blog posts about Windows PowerShell and the Legacy. I am not going to be redundant […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[36,16,56,269,37,3,154,45],"class_list":["post-13731","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-client-side-management","tag-desktop-management","tag-guest-blogger","tag-logon-sessions","tag-networking","tag-scripting-guy","tag-sean-kearney","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Learn how to use Windows PowerShell to discover logon session information for remote computers. Microsoft Scripting Guy, Ed Wilson, here. This week we will have one guest blogger for the entire week. Sean Kearney has written a series of blog posts about Windows PowerShell and the Legacy. I am not going to be redundant […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/13731","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=13731"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/13731\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=13731"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=13731"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=13731"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}