Restore console session after remote desktop disconnects?

Question

Is it possible (through group policy, etc) to automatically restore the console session to a Windows 8.1 PC after a remote desktop session disconnects?

I'm aware that you can run the command "tscon 1 /dest:console" during the RDP session to disconnect yourself and reconnect the console session, but is it possible to have this happen automatically?

Answer 1

Create a batch file with the following contents, named something like restore_console.bat:

@echo off
set LOG_FILENAME=%TEMP%\restore_console_log.txt
echo Script executed at %TIME% > %LOG_FILENAME%
echo qwinsta: >> %LOG_FILENAME%
qwinsta >> %LOG_FILENAME%

echo Checking for pending connection... >> %LOG_FILENAME%
for /f %%i in ('qwinsta ^| findstr /r /C:"^ [ ]*[0-9][0-9]*  Disc"') do (
echo Pending connection detected, finishing. >> %LOG_FILENAME%
goto end
)

echo Checking for disconnection... >> %LOG_FILENAME%
for /f "tokens=2" %%i in ('qwinsta ^| findstr /r /I /C:"^ [ ]*[^ ][^ ]* [ ]*[0-9][0-9]*  Disc"') do (
echo Redirecting session id %%i >> %LOG_FILENAME%
tscon %%i /dest:console /v >> %LOG_FILENAME%
goto end
)

:end

In Task Scheduler, create a new task, with the following settings:

• General -> Run whether user is logged on or not, Run with Highest privileges.
• Triggers -> New -> On disconnect from user session, Any user, Connection from remote computer
• Actions -> New -> Start a program -> Program/script: <your batch file>
• Everything else default.

Notes regarding implementation:

• this works by parsing the qwinsta output through a findstr regex, i.e. extracting the ID from line 3 here:

   SESSIONNAME       USERNAME                 ID  STATE   TYPE        DEVICE 
  >services                                    0  Disc                        
                     ######                    2  Disc                        
   console                                     7  Conn                        
   #############...                        65536  Listen                      
   rdp-tcp                                 65537  Listen                      
  

• the middle block is necessary because for some reason the schedule task executes on connection as well as disconnection. When this happens, the output will be of the form:

   SESSIONNAME       USERNAME                 ID  STATE   TYPE        DEVICE 
  >services                                    0  Disc                        
                     ######                    2  Disc                        
                                               3  Disc                        
   console                                     8  Conn                        
   #############...                        65536  Listen                      
   rdp-tcp                                 65537  Listen                      
  

  Therefore we look for lines of the pattern from line 4.

• it dumps logging information to %TEMP%\restore_console_log.txt, which is not necessary, but useful if the script doesn't work. Without the logging it would be only a few lines.

This worked for me on a single Windows 8.1 machine - I don't know if it could be rolled out globally.

Answer 2

@Kim's answer is great. Unfortunately for us, it appears Microsoft broke starting a scheduled task on remote connect/disconnect in Windows 10. No matter what I did, I couldn't get any task, much less this one, to run when connecting or disconnecting via remote desktop.

Fortunately triggering on generic events still works. This question about where events are logged for remote desktop disconnects gave me a starting point, and trial and error yielded the right one.

Change the trigger to be "On an event" from Log "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational", Source "TerminalServices-LocalSessionManager", Event ID "24". (I originally recommended 40 - both seem to work, but 40 is a bit noisier, possibly occurring multiple times on a disconnect. If 24 doesn't work, try 40 and let us know.) See screenshot below.

Answer 3

I know this is a bit old, but it should be possible to write a quick Windows service which monitors the connections and restores the console session when it sees that the RDP is now in a disconnected state. Slightly less work would be to use a batch file utilizing srvany to run it as a service, just have it monitor the values returned from qwinsta.

I'd recommend doing the batch/srvany as a state machine. First, the batch file monitors for an RDP connection and continues monitoring until it sees one. Then it moves into the next state where it waits for that RDP session to be done. When it detects the session has been disconnected (not logged off) it moves to the final state which is to restore that session to the console. Finally, it moves back into the original state of monitoring for an RDP session.

I'm not saying it would be easy, but it should be possible. Mainly I wanted to offer up the suggestion because your "tscon [sessionID] /dest:console" saved me a lot of headache.