PowerShell \u0441\u043a\u0440\u0438\u043f\u0442 Get-UserSession<\/p>\n
<\/p>\n
function\u00a0 {
\n<#
\n.SYNOPSIS
\nRetrieves all user sessions from local or remote computers(s)<\/p>\n
.DESCRIPTION
\nRetrieves all user sessions from local or remote computer(s).<\/p>\n
Note:\u00a0\u00a0 Requires query.exe in order to run
\nNote:\u00a0\u00a0 This works against Windows Vista and later systems provided the following registry value is in place
\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\AllowRemoteRPC = 1
\nNote:\u00a0\u00a0 If query.exe takes longer than 15 seconds to return, an error is thrown and the next computername is processed.\u00a0 Suppress this with -erroraction silentlycontinue
\nNote:\u00a0\u00a0 If $sessions is empty, we return a warning saying no users.\u00a0 Suppress this with -warningaction silentlycontinue<\/p>\n
.PARAMETER computername
\nName of computer(s) to run session query against<\/p>\n
.parameter parseIdleTime
\nParse idle time into a timespan object<\/p>\n
.parameter timeout
\nSeconds to wait before ending query.exe process.\u00a0 Helpful in situations where query.exe hangs due to the state of the remote system.<\/p>\n
.FUNCTIONALITY
\nComputers<\/p>\n
.EXAMPLE
\nGet-usersession -computername “server1″<\/p>\n
Query all current user sessions on ‘server1’<\/p>\n
.EXAMPLE
\nGet-UserSession -computername $servers -parseIdleTime | ?{$_.idletime -gt [timespan]”1:00”} | ft -AutoSize<\/p>\n
Query all servers in the array $servers, parse idle time, check for idle time greater than 1 hour.<\/p>\n
.NOTES
\nThanks to Boe Prox for the ideas – http:\/\/learn-powershell.net\/2010\/11\/01\/quick-hit-find-currently-logged-on-users\/<\/p>\n
.LINK
\nhttp:\/\/gallery.technet.microsoft.com\/Get-UserSessions-Parse-b4c97837<\/p>\n
#>
\n[cmdletbinding()]
\nParam(
\n[Parameter(
\nPosition = 0,
\nValueFromPipeline = $True)]
\n[string[]]$ComputerName = “localhost”,<\/p>\n
[switch]$ParseIdleTime,<\/p>\n
[validaterange(0,120)]
\n[int]$Timeout = 15
\n)
\nProcess
\n{
\nForEach($computer in $ComputerName)
\n{<\/p>\n
#start query.exe using .net and cmd \/c.\u00a0 We do this to avoid cases where query.exe hangs<\/p>\n
#build temp file to store results.\u00a0 Loop until we see the file
\nTry
\n{
\n$Started = Get-Date
\n$tempFile = [System.IO.Path]::GetTempFileName()<\/p>\n
Do{
\nstart-sleep -Milliseconds 300<\/p>\n
if( ((Get-Date) – $Started).totalseconds -gt 10)
\n{
\nThrow “Timed out waiting for temp file ‘$TempFile'”
\n}
\n}
\nUntil(Test-Path -Path $tempfile)
\n}
\nCatch
\n{
\nWrite-Error “Error for ‘$Computer’: $_”
\nContinue
\n}<\/p>\n
#Record date.\u00a0 Start process to run query in cmd.\u00a0 I use starttime independently of process starttime due to a few issues we ran into
\n$Started = Get-Date
\n$p = Start-Process -FilePath C:\\windows\\system32\\cmd.exe -ArgumentList “\/c query user \/server:$computer > $tempfile” -WindowStyle hidden -passthru<\/p>\n
#we can’t read in info or else it will freeze.\u00a0 We cant run waitforexit until we read the standard output, or we run into issues…
\n#handle timeouts on our own by watching hasexited
\n$stopprocessing = $false
\ndo
\n{<\/p>\n
#check if process has exited
\n$hasExited = $p.HasExited<\/p>\n
#check if there is still a record of the process
\nTry
\n{
\n$proc = Get-Process -id $p.id -ErrorAction stop
\n}
\nCatch
\n{
\n$proc = $null
\n}<\/p>\n
#sleep a bit
\nstart-sleep -seconds .5<\/p>\n
#If we timed out and the process has not exited, kill the process
\nif( ( (Get-Date) – $Started ).totalseconds -gt $timeout -and -not $hasExited -and $proc)
\n{
\n$p.kill()
\n$stopprocessing = $true
\nRemove-Item $tempfile -force
\nWrite-Error “$computer`: Query.exe took longer than $timeout seconds to execute”
\n}
\n}
\nuntil($hasexited -or $stopProcessing -or -not $proc)<\/p>\n
if($stopprocessing)
\n{
\nContinue
\n}<\/p>\n
#if we are still processing, read the output!
\ntry
\n{
\n$sessions = Get-Content $tempfile -ErrorAction stop
\nRemove-Item $tempfile -force
\n}
\ncatch
\n{
\nWrite-Error “Could not process results for ‘$computer’ in ‘$tempfile’: $_”
\ncontinue
\n}<\/p>\n
#handle no results
\nif($sessions){<\/p>\n
1..($sessions.count – 1) | Foreach-Object {<\/p>\n
#Start to build the custom object
\n$temp = “” | Select ComputerName, Username, SessionName, Id, State, IdleTime, LogonTime
\n$temp.ComputerName = $computer<\/p>\n
#The output of query.exe is dynamic.
\n#strings should be 82 chars by default, but could reach higher depending on idle time.
\n#we use arrays to handle the latter.<\/p>\n
if($sessions[$_].length -gt 5){<\/p>\n
#if the length is normal, parse substrings
\nif($sessions[$_].length -le 82){<\/p>\n
$temp.Username = $sessions[$_].Substring(1,22).trim()
\n$temp.SessionName = $sessions[$_].Substring(23,19).trim()
\n$temp.Id = $sessions[$_].Substring(42,4).trim()
\n$temp.State = $sessions[$_].Substring(46,8).trim()
\n$temp.IdleTime = $sessions[$_].Substring(54,11).trim()
\n$logonTimeLength = $sessions[$_].length – 65
\ntry{
\n$temp.LogonTime = Get-Date $sessions[$_].Substring(65,$logonTimeLength).trim() -ErrorAction stop
\n}
\ncatch{
\n#Cleaning up code, investigate reason behind this.\u00a0 Long way of saying $null….
\n$temp.LogonTime = $sessions[$_].Substring(65,$logonTimeLength).trim() | Out-Null
\n}<\/p>\n
}<\/p>\n
#Otherwise, create array and parse
\nelse{
\n$array = $sessions[$_] -replace “\\s+”, ” ” -split ” ”
\n$temp.Username = $array[1]<\/p>\n
#in some cases the array will be missing the session name.\u00a0 array indices change
\nif($array.count -lt 9){
\n$temp.SessionName = “”
\n$temp.Id = $array[2]
\n$temp.State = $array[3]
\n$temp.IdleTime = $array[4]
\ntry
\n{
\n$temp.LogonTime = Get-Date $($array[5] + ” ” + $array[6] + ” ” + $array[7]) -ErrorAction stop
\n}
\ncatch
\n{
\n$temp.LogonTime = ($array[5] + ” ” + $array[6] + ” ” + $array[7]).trim()
\n}
\n}
\nelse{
\n$temp.SessionName = $array[2]
\n$temp.Id = $array[3]
\n$temp.State = $array[4]
\n$temp.IdleTime = $array[5]
\ntry
\n{
\n$temp.LogonTime = Get-Date $($array[6] + ” ” + $array[7] + ” ” + $array[8]) -ErrorAction stop
\n}
\ncatch
\n{
\n$temp.LogonTime = ($array[6] + ” ” + $array[7] + ” ” + $array[8]).trim()
\n}
\n}
\n}<\/p>\n
#if specified, parse idle time to timespan
\nif($parseIdleTime){
\n$string = $temp.idletime<\/p>\n
#quick function to handle minutes or hours:minutes
\nfunction Convert-ShortIdle {
\nparam($string)
\nif($string -match “\\:”){
\n[timespan]$string
\n}
\nelse{
\nNew-TimeSpan -Minutes $string
\n}
\n}<\/p>\n
#to the left of + is days
\nif($string -match “\\+”){
\n$days = New-TimeSpan -days ($string -split “\\+”)[0]
\n$hourMin = Convert-ShortIdle ($string -split “\\+”)[1]
\n$temp.idletime = $days + $hourMin
\n}
\n#. means less than a minute
\nelseif($string -like “.” -or $string -like “none”){
\n$temp.idletime = [timespan]”0:00″
\n}
\n#hours and minutes
\nelse{
\n$temp.idletime = Convert-ShortIdle $string
\n}
\n}<\/p>\n
#Output the result
\n$temp
\n}
\n}
\n}
\nelse
\n{
\nWrite-Warning “‘$computer’: No sessions found”
\n}
\n}
\n}
\n}<\/p>\n
\u041f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u043e\u0432: 12<\/p>","protected":false},"excerpt":{"rendered":"
PowerShell \u0441\u043a\u0440\u0438\u043f\u0442 Get-UserSession \u041f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u043e\u0432: 12<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[104],"class_list":["post-411","post","type-post","status-publish","format-standard","hentry","category-itmemo","tag-powershell--get-usersession"],"_links":{"self":[{"href":"https:\/\/www.it-earth.ru\/index.php?rest_route=\/wp\/v2\/posts\/411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.it-earth.ru\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.it-earth.ru\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.it-earth.ru\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.it-earth.ru\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=411"}],"version-history":[{"count":1,"href":"https:\/\/www.it-earth.ru\/index.php?rest_route=\/wp\/v2\/posts\/411\/revisions"}],"predecessor-version":[{"id":414,"href":"https:\/\/www.it-earth.ru\/index.php?rest_route=\/wp\/v2\/posts\/411\/revisions\/414"}],"wp:attachment":[{"href":"https:\/\/www.it-earth.ru\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.it-earth.ru\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.it-earth.ru\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}