How to see users' idle time on RDP server

Query User / QUSER.exe

Using the quser command, you can view when a user RDP session was started, how long it was idle and the current session state.

quser [<username> | <sessionname> | <sessionID>] [/server:<servername>]

• To use this command, you must have Full Control permission or special access permission.

• If you don't specify a user using the <username>, <sessionname>, or sessionID parameters, a list of all users who are logged on to the server is returned. Alternatively, you can also use the query session command to display a list of all sessions on a server.

• When quser returns information, a greater than (>) symbol is displayed before the current session.

Display information about user sessions on a Terminal server or a Remote Desktop Session Host (RD Session Host) server.

Key
   UserName    The logon username of the user whose sessions you want to query.

   SessionName The name of the session that you want to query.

   SessionID   The ID of the session that you want to query.

   /server:ServerName
               The Remote Desktop Session Host server to query.
               The default is the current server.

   /?          Display help.

QUERY USER is a synonym for QUSER.exe

Available to 64 bit sessions only, there are no 32 bit implementations of QUSER.exe (QUERY USER).

Query User returns the following information:

• The name of the user
• The name of the session on the RD Session Host server
• The session ID
• The state of the session (active or disconnected)
• The idle time (the number of minutes since the last keystroke or mouse movement at the session)
• The date and time the user logged on

If you do not specify a user by using UserName, SessionName, or SessionID, a list of all users who are logged on to the server is returned. Alternatively, use query session to display a list of all sessions on the server. When information for multiple users is returned, a greater than > symbol is displayed before the current session.

A user can always query the session to which the user is currently logged on. To query other sessions, the user must have Query Information special access permission.

The User Access permission type grants the following special permissions: Query Information, Logon, and Connect. These special permissions allow a user to: Log on to a session on the terminal server. Query information about a session. Send messages to other user sessions. Connect to another session.

Permissions are set under:

Terminal Services Configuration ➞ Connections ➞ Properties ➞ Permissions ➞ Advanced ➞ Permissions

PowerShell

When running quser under PowerShell it is useful to split the output into rich objects, this can be done with a regex and ConvertFrom-Csv:

(quser) -replace '\s{2,}', ',' | ConvertFrom-Csv

Alternatively the script Get-LoggedOnUser.ps1 will also show disconnected sessions.

Examples

Display information about all users logged on the system:

C:\> query user

Display information about the user ursula on server64:

C:\> quser ursula /server:Server64