Qwinsta server ошибка 5 получения имен сеансов

Despite having no issue connecting with the
Remote Desktop
Connection, I’m receiving an «access is
denied» error
» error. The targets are either WinXP or Server 2003, while my computer is Win7. It’s possible that I’m not correctly specifying the server name, which is why I’ve attempted the following options:

qwinsta /SERVER:XXYYZZ02


qwinsta /SERVER:\XXYYZZ02


\
\ \ \ \ qwinsta\ /SERVER:domain\XXYYZZ02\
\ \ \


qwinsta /SERVER:domain/XXYYZZ02


qwinsta /SERVER:1.2.3.4


I’m wondering if I’m making an error. Thanks in advance.
I’m trying to tackle an issue where multiple support staff members have to link to the same servers, and they end up disconnecting each other during their sessions.

This solution on Dell’s website resolved my problem, which was identical.

The reason behind the failure of the requested operation by the remote RPC component is that operating on terminal service (Remote Desktop) through RPC is prohibited by default. To enable the Remote Desktop API through RPC, you must locate the specified registry key and modify its settings.


\
\ \ \ \ \ HKLM\SYSTEM\CurrentControlSet\Control\Terminal\ Server\
\ \ \ \


Create a DWORD value called «AllowRemoteRPC» and adjust its value to 1.

The value was initially set to «0» in my case, but changing it to 1 resolved the issue.

For accurate command names and substitutes, please consult this webpage: http://makezine.com/2007/08/15/howto-kill-terminal-services-s/.

Consider running your operation with administrator privileges using
cmd window
.

Is it possible for you to log in using an alternative method such as mstsc /console or virtual console? This would allow you to verify the server authentication settings on the servers.

Some time ago, I needed to identify the routes in C#, and to accomplish this task, I utilized the code below.

        ManagementObjectSearcher searcher = new ManagementObjectSearcher("root\\CIMV2", "SELECT * FROM Win32_IP4RouteTable");
        foreach (ManagementObject queryObj in searcher.Get())
        {
            string destination = queryObj["Destination"].ToString();
            string mask = queryObj["Mask"].ToString();
            string metric = queryObj["Metric1"].ToString();
            string interfaceIndex = queryObj["InterfaceIndex"].ToString();
            string nexthop = queryObj["NextHop"].ToString();
            ...
        }

I am interested in logging off a remote desktop session and I am aware that this can be achieved using qwinsta commands. However, I am curious if there is a method to obtain the qwinsta output in C# similar to the aforementioned solution for netstat.

It has been discovered that the session ID for a particular server can be obtained through the use of the Cassia library.

        ITerminalServicesManager manager = new TerminalServicesManager();
        using (ITerminalServer server = manager.GetRemoteServer(serverName))
        {
            server.Open();
            foreach (ITerminalServicesSession session in server.GetSessions())
            {
                 NTAccount account = session.UserAccount;
                if (account != null)
                {
                    if (account.ToString() == username)
                    {
                        Disconnect(serverName, session.SessionId);
                    }
                }
            }
        }

Using the aforementioned code, you can extract the necessary information for disconnecting. However, the method for performing the disconnection remains unknown as attempting to execute the logoff command via C# results in an error.

* EDIT *

I have discovered an alternative method of logging off from a remote server programmatically, which does not involve the use of logoff.exe.

    [DllImport("wtsapi32.dll", SetLastError = true)]
    static extern bool WTSLogoffSession(IntPtr hServer, int SessionId, bool bWait);
    [DllImport("wtsapi32.dll", SetLastError = true)]
    static extern IntPtr WTSOpenServer([MarshalAs(UnmanagedType.LPStr)] String pServerName);
    private void Disconnect(string serverName, int sessionId)
    {
        IntPtr server = WTSOpenServer(serverName);
        WTSLogoffSession(server, sessionId, false);
    }

The ‘Query Session’ command in cmd is currently producing results.

Error 5 getting sessionnames
Error [5]:Access is denied

Using the Administrator user on Remote desktop for Windows 10.

We have assigned a value of 1 to

AllowRemoteRPC

.

under this

\
\ \ \ \ HKLM\SYSTEM\CurrentControlSet\Control\Terminal\ Server\
\ \ \


But still problem persists.

Questions:

• Can you explain the purpose of
  
AllowRemoteRPC

  and how its value is utilized?
• How to enable Query Session command functionality?

It appears that the issue lies within the limitations imposed by UAC on remote access.

Do this on the target computer:

• Run
  
regedit


• Navigate to the following registry subkey:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
  

• If an entry named
  
LocalAccountTokenFilterPolicy

  registry entry does not exist,
  create it as DWORD

• Double-click
  
LocalAccountTokenFilterPolicy

  and set its value to
  
1

  .

Reference:

Windows Vista’s User Account Control and remote limitations were explained in detail by Microsoft.

Instead of relying on
changing registry
values, you have the option to utilize

PSEXEC

from a command prompt or use Invoke-Command from a PowerShell prompt to run

QWINSTA

on the local machine. For either option, it is necessary to have administrative privileges on the remote machine. This means that you will need to launch the command prompt using alternate credentials, such as those provided by

PSEXEC

switches. Alternatively, if using PowerShell, you can include

-Credential (Get-Credential)

in the command.

Command prompt example:

PSEXEC \\MYPC cmd /c "qwinsta /server:localhost"

PowerShell example:

Invoke-Command -ComputerName MyPC -ScriptBlock { qwinsta /server:localhost }

My VBScript is designed to track remote user activity on a server by utilizing «qwinsta» to obtain usernames. I can efficiently monitor user sessions by continuously looping until a disconnect is detected.

After conducting a thorough search, I have not been able to find any cmd or wmi command that provides the hostname or IP address of a remote user based on their session ID or username. Unfortunately, the qwinsta command is also unable to provide this information.

Are there any alternative suggestions to obtain this information? I came across an external tool that displays the IP address, but I prefer not to use it. I believe it may be using WMI or another method to retrieve the IP address which I could potentially implement into my own script.

Although netstat and
filter port
3389 can help me identify RDP sessions and their corresponding IPs, I have no means of determining which
IP belongs
belongs to which user.

The (mostly) undocumented API WinStationQueryInformationW is the only means to access this information, as it is not available through WMI, command line utility, or any COM object to my knowledge.

If you are proficient in a .NET language, the Cassia library can be utilized to manage the Win32 API calls. You may refer to ITerminalServicesSession.RemoteEndPoint and download the latest trunk build as a guest. Although I haven’t attempted it yet, utilizing
tlbexp
and regasm should enable the use of Cassia from VBScript.

In a
batch file
, you can utilize the below code to input a text file of hostnames into an array and retrieve rdp session information for each of them. Ensure that the batch file you create is placed beside the Server_List.txt file.

@echo off
setlocal EnableDelayedExpansion
echo RDPSessionINFO > ./results.txt
echo ============== >> ./results.txt
set i=0
for /F %%a in (Server_List.txt) do (
   set /A i+=1
   set array[!i!]=%%a
)
set n=%i%
for /L %%i in (1,1,%n%) do echo !array[%%i]! >> ./results.txt && qwinsta /server:!array[%%i]!>> ./results.txt && echo =================== >> ./results.txt
start notepad.exe ./results.txt