5

I have a question which I'm sure has a simple solution, but it keeps eluding me.

There's a server in the picture that is used by several people.
All of them use the same account to log in.
The only way to differentiate sessions would be by hostname or IP.

So - How to see, on the remote computer, a hostname of the client connected?

For example, I RDP in to the server 256.12.13.1 from my IP 256.12.13.7.
Is there a command I could run on the server in that remote session that will output 256.12.13.7?

I ask because it would be good if that command would output 256.12.13.9 when person connects from that other IP.

So I can put it in startup and whenever someone connects script like this would run:

gethostname >> rdplog.txt<br>
date /t >> rdplog.txt <br>
time /t >> rdplog.txt

So this can basically equal to a very simple login log.

3
  • I'm looking into powershell now. I guess that's my only option left. Feb 24, 2012 at 8:41
  • 2
    Obviously, few people can dictate how a business uses IT resources, but may I suggest that multiple people using the same login is extremely poor security practice? If you are in the position to improve this system, I would recommend it. Mar 15, 2012 at 20:45
  • @MyrddinEmrys, You are absolutely correct. But no, I can not make the change in the system as it is now, I did try already :) However, it's a LAN environment and people do not store much important data so it is okay. The only thing I am concerned about is data corruption, but this is where backup kicks in ;) Thank you for your thoughts though, much appreciated! Mar 16, 2012 at 9:19

4 Answers 4

7

You could write a batch script like:

netstat -na | find "3389" | find "ESTABLISHED" >> C:\path_to_rdplog.txt
date /T >> C:\path_to_rdplog.txt
time /T >> C:\path_to_rdplog.txt
echo. >> C:\path_to_rdplog.txt
echo ----------- >> C:\path_to_rdplog.txt
echo. >> C:\path_to_rdplog.txt

You just have to make sure that the person who's logging in has write permissions to C:\path_to_rdplog.txt

3
  • Exactly what I needed! How could I have made such an oversight? netstat! Thank you matrixx333, you just made my day. Of course, I edited the script a bit more to suit my needs better, but you made a hell of a job sir. Thank you very much! :-) Mar 16, 2012 at 9:23
  • 1
    Glad I could help you out @extremko!
    – matrixx333
    Mar 16, 2012 at 9:37
  • Though I suspect this wouldn’t give the right answer when multiple clients are connected and you want to discover the client connected to the currently active session.
    – binki
    Mar 2, 2016 at 21:31
3

A very old thread but anyway. We used to check an environment variable CLIENTNAME that is set in the RDP session. We had an older application that could not easily use windows API's or Powershell and checked this environment variable. This variable holds the hostname of the client machine making the RDP connection.

1
  • I appreciate the update, even with the thread being old. Clientname variable would certainly resolve my issue back then! Thanks for the update! Oct 17, 2017 at 17:11
2

Microsoft MVP Shay Levy made a PSTerminalServices PowerShell module that has Terminal Services cmdlets.

It needs to be installed, it is not there by default.

I have not used it yet, I just found it.

1
  • Thanks for the suggestion. Haven't tried it, but will :) Mar 16, 2012 at 9:21
2

A new Powershell answer to a rather old question

(Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational';ID=1149;StartTime=(Get-Date).AddDays(-31);} | ForEach-Object {[PSCustomObject] @{User=$_.Properties[0].Value;ClientName=$_.Properties[1].Value;IPAddress=$_.Properties[2].Value; TimeCreated=$_.TimeCreated;}} | Where-Object User -eq $env:USERNAME | Sort-Object -Property TimeCreated -Descending | Select-Object -First 1).ClientName

The snippet grabs all the events from the event log for Terminal Services over the past 31 days and builds custom objects with the user name, the client name, the ip address and the timestamp of the logon entry. It then filters the custom objects using the name of the current user and then sorts the custom objects in descending order of login date and finally grabs the top most (i.e. most recent event log entry), and extracts the Client Name from the custom object. I am literally walking thru the code and explaining each piece of code sequentially - there really is not a whole lot to the code.

What is important to note is that the event log has a record of successful RDP connections with the data of interest to us. Parsing, filtering, sorting, and extracting the relevant data to turn it into useful information is the name of the game!

1
  • You could improve your answer by explaining it. Jan 25, 2023 at 21:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .