Based on subcoder's answer based on Uramanathan's answer, with additions from Duncan and Jimadine's comments, I created a scheduled task that runs when closing/disconnecting the RDP connection. It required a slight tweak to the findstr command to search for %USERNAME%
instead of Active
, because at the time of the triggering event, the session is already in the Disc
state.
The task is triggered by the Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
event log getting a logoff event (EventID=24
). Then it runs a simple command whenever a user logs off. The command gets the query session
output which looks like:
SESSIONNAME USERNAME ID STATE TYPE DEVICE
services 0 Disc
>rdp-tcp#0 Matt 2 Active
console 5 Conn
rdp-tcp 65536 Listen
It searches for %USERNAME%
(in my case "Matt") and gets the ID column for that row. It passes the ID to the tscon
command with %k /Dest:console
, which unlocks the screen for the logged in user. This command probably only works if the user logging in remotely is the same user logged in locally, but I haven't tested.
Here's a task scheduler XML to import. The Author and UserId elements are removed and will be automatically filled in with your user when you import the task.
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Date>2022-02-10T11:17:45.9347484</Date>
<URI>\Unlock remote screen</URI>
</RegistrationInfo>
<Triggers>
<EventTrigger>
<Enabled>true</Enabled>
<Subscription><QueryList><Query Id="0" Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"><Select Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">*[System[Provider[@Name='Microsoft-Windows-TerminalServices-LocalSessionManager'] and (EventID=24)]]</Select><Suppress Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">*[UserData[EventXML[Address="LOCAL"]]]</Suppress></Query></QueryList></Subscription>
</EventTrigger>
</Triggers>
<Principals>
<Principal id="Author">
<LogonType>InteractiveToken</LogonType>
<RunLevel>HighestAvailable</RunLevel>
</Principal>
</Principals>
<Settings>
<MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT1H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>C:\Windows\System32\cmd.exe</Command>
<Arguments>/C "for /F "tokens=1,2,3 delims= " %i in ('query session ^| findstr "%USERNAME%"') do tscon %k /Dest:console"</Arguments>
<WorkingDirectory>%USERPROFILE%</WorkingDirectory>
</Exec>
</Actions>
</Task>