Function Get-WMIComputerSessions {
<#
.SYNOPSIS
Retrieves all user sessions on a local or remote system.
.DESCRIPTION
Retrieves all user sessions on a local or remote system.
.PARAMETER computer
Name of computer/s to run session query against.
.NOTES
Name: Get-WmiComputerSessions
Author: Boe Prox
DateCreated: 01Nov2010
.LINK
https://boeprox.wordpress.org
.EXAMPLE
Get-WmiComputerSessions -computer "server1"
Description
-----------
This command will query all current user sessions on 'server1'.
#>
[cmdletbinding(
DefaultParameterSetName = 'session',
ConfirmImpact = 'low'
)]
Param(
[Parameter(
Mandatory = $True,
Position = 0,
ValueFromPipeline = $True)]
[string[]]$computer
)
Begin {
#Create empty report
$report = @()
}
Process {
#Iterate through collection of computers
ForEach ($c in $computer) {
#Get explorer.exe processes
$proc = gwmi win32_process -computer $c -Filter "Name = 'explorer.exe'"
#Go through collection of processes
ForEach ($p in $proc) {
$temp = "" | Select Computer, Domain, User
$temp.computer = $c
$temp.user = ($p.GetOwner()).User
$temp.domain = ($p.GetOwner()).Domain
$report += $temp
}
}
}
End {
$report
}
}
This script/command requires Administrative privileges to connect to WMI.
Run the script by using the following command:
Get-WMIComputerSessions -computer Localhost