Listing all current RDP sessions

Question

We're running a certain application on a client's server. The app runs on the console session, and basically manages some batch processing. Every once in a while we discover the app is not running, and obviously this only happens after the client complains about the app's job not getting done. The reasons for the app's shutdown vary from internal error to deliberate shutdown to server restart. If the latter, I can see the evidence in the event viewer. On the other cases, I'm looking for a way to discover who was logged on at the time the app was shut down.

What seems reasonable to me is running the app via a batch file, and once the app is closed the batch commands that will follow will list the currently logged on users, one of which probably responsible for the shutdown. The problem is everyone logs into the server using the network admin credentials(!), and different sessions can be told apart only by the user's machine name.

It is worth mentioning that:

1. The app does a classic service job, but it can't be converted to one.
2. I tried some Sysinternal tools, but none listed the info I needed.
3. I'd rather not use the event viewer. It's swamped as it is. Log files are better.

Solution

Update:: So maybe

netstat -n -a | findstr 3389

is what you are looking for.

**Before update:**I think that what you are looking for is:

query session
query user

But, at most, those are band-aid. You should take a step back, and solve this on a deeper level. maybe a watchdog service or something like that.

Comments

[Ilia Liachin]

Net session was one of the first things I had in mind too, but it yielded some weird-looking results... On a server with 3 logged in users, only one session was listed, and it was coming from an unreachable IP. On another server with only me logged in, another user was listed. How the command gets its info is beyond me...

[HK_]

Oops. Can you use psloggedon and parse the output?

[Ilia Liachin]

As for the query commands, neither show the name or IP of the computer from which the user has connected. Given all users log on as "administrator", the source details is what I'm missing. As for your second comment, in principle you're right, hence my note about running as a service. But life is full of compromises - product versions, priorities, payments etc. A band-aid is just the only option on the table at the moment.

[Ilia Liachin]

The problem with %clientname% is that it seems to hold the name of the workstation from which the log on has been done, and not the one who's currently connected. In our case, we're using the console session. When I connect to the console and check the clientname, I see the name of some other workstation. It's probably the one who first logged on to the console session, but since we all use the same user, we all connect to the same session. As a result, clientname never changes. Awkward, but given.