Remote desktop - detect when someone is connected?

[theniteowl]

I work on a team that administers several Win 2003 servers via Remote Desktop. We connect using the /console switch.

The server is logged on with a local account to run an application that manages print processing so we connect in console mode.

Is there a way to detect when someone else is connected via Remote Desktop? Currently if one of us tries to go to the box while someone else is connected it drops the other person. We have to always ask around to see if the connection is free before attempting connection but sometimes people are working remotely and we cannot ask without email or instant messenger.

I am hoping to find a programmatic method for detecting when the connect is free/busy and/or some switch that prevents the connection from occuring if it is already taken.

Anybody?

At my age I still learn something new every day, but I forget two others.

 

[itsp1965]

Well if you don't want to monitor using the Terminal Services Mgr you can always run the command

QUERY USER /SERVER:<servername>

This will tell you who is currently logged on. You can set it up in a batch file and run it at any time

 

[GrimR]

Here is a script that will tell you at what time and from where the person connected, I don't think you will be able to detect if the session is open, as it's not a true TS connection.

strComputer = "computerName"
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate,(Security)}!\\" & _
        strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery _
    ("Select * FROM Win32_NTLogEvent WHERE Logfile = 'Security'  AND EventType = 4 AND EventCode = 682")
For Each objEvent in colLoggedEvents 
    Wscript.Echo "Connecting To: " & objEvent.ComputerName
    Wscript.Echo "Message: " & objEvent.Message
    dtmEventDate = objEvent.TimeWritten
    strTimeWritten = WMIDateStringToDate(dtmEventDate)
    Wscript.Echo "Time Written: " & strTimeWritten
Next

Function WMIDateStringToDate(dtmEventDate)
    WMIDateStringToDate = CDate(Mid(dtmEventDate, 5, 2) & "/" & _
        Mid(dtmEventDate, 7, 2) & "/" & Left(dtmEventDate, 4) _
            & " " & Mid (dtmEventDate, 9, 2) & ":" & _
                Mid(dtmEventDate, 11, 2) & ":" & Mid(dtmEventDate, _
                    13, 2))
End Function

 

[theniteowl]

Unfortunately neither approach is working.
Where would QUERY USER normally be executed?
I substituted qwinsta.exe /SERVER:myserver which gave me odd results.
3 of the 4 servers report no connection but should be showing the local account being logged on and that RDP is listening. It also failed to show the connection when I remoted into the console on those boxes.
The 4th server shows that a console connection is active when none are.

As for the VBS code, I tried it and a similar code I found elsewhere but WMI seems to not be enabled on the servers.
I could substitute a server name where I know WMI is enabled and both scripts work but not on the boxes I need to check.

I do not know if it is safe to enable WMI on our servers, they are vendor supported appliances and I do not know what effect WMI might have on the running applications.

Any chance of an mstsc switch that prevents connection if it is already connected to console by someone else?



At my age I still learn something new every day, but I forget two others.

 

[GrimR]

The public switch lets you know the sessions
MSTSC /v:192.168.x.x:3389 /public

 

[theniteowl]

GrimR, that is interesting code. I will have to look at it more in depth and figure out what other ways I could use it.

I found code that is supposed to return info on active connections. I just have to find a box with WMI enabled that I have Remote Desktop rights to so I can test it out.

strComputer = "myserver"
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") 

set objEnum = objWMIService.execQuery("select __relpath from win32_process where caption = 'explorer.exe'")

' for testing purposes
     WScript.Echo " " & strComputer & " was contacted. Attempting to see who is logged in."

If objEnum.Count = 0 then
wscript.echo "No one currently logged in to " & strComputer & "." & VbCrLf
Else
for each obj in objEnum
	set outParams = obj.ExecMethod_("GetOwner")
	wscript.echo "User: " & outParams.User & " is currently logged in on computer " & strComputer & "." & VbCrLf
next
End If

At my age I still learn something new every day, but I forget two others.

 

[theniteowl]

Anytime I try the /public switch it brings up the help screen and does not list /public as an option. Perhaps it was removed in later versions?

Microsoft's site lists the switch as starting a session in a public mode so it sounds like it actually establishes a session rather than just reporting on them.


At my age I still learn something new every day, but I forget two others.

 

[GrimR]

I tested it on XP and Windows 2003 R2 and it shows the sessions and when they where connected and disconnected.
Are you sure it's not a port issue when trying the switch.
Just in case you want to check HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber

 

[theniteowl]

I tested again, same results.
The port number is optional but I went and looked it up just to be sure and I get the same result.
It pops up a windows box giving me the usage info for mstsc.

I have tried it with the server name, ip address and both in combination with the port number.

At my age I still learn something new every day, but I forget two others.

 

[Roadki11]

Try this, it free and will do exactly what you want.

http://www.snapfiles.com/get/royalts.html

RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen

 

[theniteowl]

The system swallowed my first response.
Unfortunately I am not able to install outside apps on the servers. They are production servers in a corporate environment and installing apps would require approval from several different areas including Information Security which would never approve a freeware remote connectivity software because of the potential for unauthorized access.

I do not know why GrimR's solution does not work, perhaps something with the way Terminal Services or Remote Desktop Access is configured on the servers.

I do have some VB code that will work but DCOM has to be enabled on the server before I can access WMI remotely.
Since DCOM is typically enabled by default there may be a reason why it has been shut off on these servers and I am hesitant to enable it without knowing more. Perhaps it is because the servers are exposed to an outside vendor and DCOM has been known to have a lot of security flaws. If they were in house accessible only it might be different.



At my age I still learn something new every day, but I forget two others.

 

[LawnBoy]

I am also unable to get the /public switch to work. XPsp2 and W2K3R2sp2.

I can get the /console switch to work, which I didn't know about and is very nice, thanks.


"We must fall back upon the old axiom that when all other contingencies fail, whatever remains, however improbable, must be the truth." - Sherlock Holmes