☰

列出用户使用远程桌面连接的所有服务器

tag-icon • tag-icon active-directory rdp
列出用户使用远程桌面连接的所有服务器

有没有办法列出整个活动目录中特定用户登录的所有服务器？

就像是...：

QueryRdpConnections -user BobAdmin

结果...：

Server         
----------------
Web001
Web002
Web003
SQL004
SQL007

答案1

您可以在 powershell 中使用 qwinsta：

QUERY SESSION [sessionname | username | sessionid]
              [/SERVER:servername] [/MODE] [/FLOW] [/CONNECT] [/COUNTER] [/VM]

  sessionname         Identifies the session named sessionname.
  username            Identifies the session with user username.
  sessionid           Identifies the session with ID sessionid.
  /SERVER:servername  The server to be queried (default is current).
  /MODE               Display current line settings.
  /FLOW               Display current flow control settings.
  /CONNECT            Display current connect settings.
  /COUNTER            Display current Remote Desktop Services counters information.
  /VM                 Display information about sessions within virtual machines.

快速搜索可让您这technet 上的文章。

我正在使用脚本的以下部分来查询所有活动服务器并查找远程登录的用户：

function QueryRdpConnections {
$ErrorActionPreference= 'silentlycontinue'
# Import the Active Directory module for the Get-ADComputer CmdLet 
Import-Module ActiveDirectory 

#Query Active Directory for computers running a Server operating system 
$Servers = Get-ADComputer -Filter {OperatingSystem -like "*server*" -and Enabled -eq 'true'} 

ForEach ($Server in $Servers) { 
    $ServerName = $Server.Name 


# Run the qwinsta.exe and parse the output 
$queryResults = (qwinsta /SERVER:$ServerName | foreach { (($_.trim() -replace "\s+",","))} | ConvertFrom-Csv)

# Pull the session information from each instance 
ForEach ($queryResult in $queryResults) { 
$RDPUser = $queryResult.USERNAME
$sessionType = $queryResult.SESSIONNAME 

# We only want to display where a "person" is logged in. Otherwise unused sessions show up as USERNAME as a number 
If (($RDPUser -match "[a-z]") -and ($RDPUser -ne $NULL)) {  

Write-Host $ServerName logged in by $RDPUser on $sessionType 
            }
        }
    }
}

我从 powershell_ise 运行它，并在第 22 行将 $RDPuser -match "%%%" 编辑为 $RDPuser -match "user1/2/3/"，以便为特定用户运行。如果您按原样运行它，它将显示所有通过 rdp 登录的用户。

相关内容