Удаленный выход из системы windows

Несколько раз встречался с ситуацией, когда один из пользователей Windows Server с ролью RDS (Remote Desktop Services) запустил приложение, которое утекло и заняло всю доступную RAM. Удаленно подключиться к такому хосту по RDP невозможно. Чтобы завершить утекший процесс, нужно выполнить удаленный логофф пользователя. Для этого можно использовать встроенную команду logoff.

Синтаксис команды logoff.exe:

logoff /server:<servername> <session ID> /v

Команда logoff принимает ID сессии пользователя, которую нужно завершить. Чтобы вывести список активных сеансов пользователей на удаленном компьютере, выполните команду:

quser /server:RemoteComputerName

USERNAME SESSIONNAME ID STATE IDLE TIME LOGON TIME
admin console 1 Active none 1/25/2023 1:23 PM

Картинка с сайта: vmblog.ru

В данном случае на компьютере выполнен локальный вход (console) под пользователем admin. ID этой сессии равно 1.

Можно получить ID сессии определенного пользователя:

quser /server:RemoteComputerName sidorov

Совет. Если пользователь подключен через Remote Desktop, в поле SESSIONNAME будет указано rdp-tcp#X.

Вы можете удаленно завершить сеанс пользователя по его ID сессии. Выполните команду:

logoff 1 /SERVER:RemoteComputerName /v

Logging off session ID 1

При завершении сеанса пользователя, будут завершены все его запущенные процессы.

Проверьте, что на удаленном компьютере не осталось активных сессий:

quser /server:RemoteComputerName

No User exists for *

Можно использовать небольшой скрипт, чтобы завершить все сеансы пользователей на нескольких терминальных серверах:

@echo off
setlocal
set servers=MSKRDS1 MSKRDS2
for %%s in (%servers%) do (
qwinsta /server:%%s | for /f "tokens=3" %%i in ('findstr /I "%username%"') do logoff /server:%%s %%i /v
)

Также для удаленного завершения сессий пользователей можно использовать встроенную утилиту rwinsta:

rwinsta rdp-tcp#12 /server:MSKRDS2

или

rwinsta 22 /server:MSKRDS2

Картинка с сайта: vmblog.ru

A Windows administrator can use the logoff command to log off a user session remotely from any Windows computer in the network. In this article, we’ll show how to get a list of sessions on a remote computer using the quser command and end the user session with logoff.

Using Command Prompt to Remotely Logoff Users

Before killing a user’s session in Windows, you need to get the user’s session ID. You can list sessions on the remote computer using the built-in quser console tool. Open a command prompt as an administrator and run the command:

quser /server:server_name

Note. To connect to a remote computer server_name, your account must be a member of the local Administrator group.

The quser command will list all sessions on the remote host, including the console session (SESSIONNAME=Console) and RDP user sessions (SESSIONNAME=rdp-tcp#X).

Картинка с сайта: theitbros.com

Note. You can also use the qwinsta command to get a list of user sessions on a remote computer:

qwinsta /server:server_name

Find the user in the list whose session you want to end. For example, we want to logoff the administrator session with the ID = 2.

To end a user session remotely, use the following command:

Logoff sessionID /server:ComputerName

In our example, this is:

Logoff 2 /server:server_name

Check that the user session has ended:

quser /server:server_name

Картинка с сайта: theitbros.com

If you want to log off a specific user by username, use the following PowerShell script:

$server = 'dc02'

$username = 'administrator'

$session = ((quser /server:$server | ? { $_ -match $username }) -split ' +')[2]

logoff $session /server:$server

Possible errors when executing the logoff command:

1. Could not logoff session ID 2, Error code 5
   Error [5]:Access is denied.
   This means that you don’t have permissions on this session or you are using a non elevated command prompt.
2. Error 0x00000005 enumerating sessionnames
   Error [5]:Access is denied.
   You are running the logoff command under a local user with administrator privileges. For such users, the Remote UAC policy is enabled by default. To disable UAC remote restrictions for local users, create the LocalAccountTokenFilterPolicy registry parameter on the target host with a value of 1.

   reg add "\\server_name\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

3. Error 0x000006BA enumerating sessionnames
   Error [1722]: The RPC server is unavailable.
   Enable RemoteRPC on the remote machine server_name:

   reg add "\\server_name\HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v AllowRemoteRPC /t Reg_Dword /d 0x1 /f

Logoff Remote Desktop Services Users Using PowerShell

You can use the command prompt to remotely log off user sessions on Windows Server hosts with Remote Desktop Services (RDS) deployed. An RDS server can have multiple user sessions active at the same time.

If you plan to put the RDShost into maintenance mode or install updates, you need to logoff all user sessions remotely. To do this, you first need to put the RDS host in the Drain mode (in this mode, the RDS host blocks new RD connections):

Invoke-Command -ComputerName NYRDS1 ScriptBlock{ change logon /drain }

Now you can end all sessions remotely using a PowerShell script:

$Server='rds01'

try {

query user /server:$Server 2>&1 | select -skip 1 | % {logoff ($_ -split "\s+")[-6] /server:$Server /V}

}

catch {}

Or, you can only logoff RDS user sessions in a disconnected state:

$Server='rds01'

try {

query user /server:$Server 2>&1 | select -skip 1 | ? {($_ -split "\s+")[-5] -eq 'Disc'} | % {logoff ($_ -split "\s+")[-6] /server:$Server /V}

}

catch {}

Картинка с сайта: theitbros.com

Here is a quick and easy way to remotely log off end users who are still logged into their computers. This is especially useful when you are trying to do maintenance.

End users are sometimes logged into their computers for far too long. It seems like every time you’d like to do some maintenance on the computer that requires a user logging out, they don’t seem to do it or the computer is idling with them logged in!
Luckily, we can take this into our own hands by forcing a logoff remote from another computer.

Using PowerShell, we can create a script that reaches out to one or more remote Windows computers, checks to see if anyone is logged in and, if so, logs them out. We can even log off all users if we so desire.

Before we get too crazy though, we first need to figure out how to find which users are logged into a remote computer.

Checking Who Is Logged-in

There are a few ways to do that but I’ve chosen to use the quser command. This is a non-PowerShell command but we can still just as easily use it from within PowerShell.

You can play around with this command by running it locally on your Windows computer to get an idea of the output.

PS> quser
  USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
 >administrator         console             1  Active      none   9/22/2018 11:04 AM

However, we’ll be using PowerShell to parse this string output so you don’t have to worry about it in the first place!

The quser command also can query remote computers using the /server switch, however, I have chosen not to use this method because we now have the advantage of using PowerShell Remoting. Instead, we can run quser by itself
on the remote computer.

PS> Invoke-Command -ComputerName 'REMOTECOMPUTER' -ScriptBlock { quser }
  USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
  abertram              rdp-tcp#7           2  Active          7  9/26/2018 4:57 PM

Remote Logoff in PowerShell

Now that you know of how to find the logged in users, we now need to figure out how to log off a user. I’ve chosen to use the logoff command. The logoff command is another non-PowerShell command, but is easy enough to
call from within a script.

In the example above, ‘abertram’ is logged into the remote computer in session 2. Using the logoff command, we simply need to pass the session ID to the command as an argument and it will dutifully log the user off as expected.

PS> Invoke-Command -ComputerName 'REMOTECOMPUTER' -ScriptBlock { logoff 2 }

I can run quser again on the remote computer and we can now see that it has been logged off.

PS> Invoke-Command -ComputerName 'REMOTECOMPUTER' -ScriptBlock {quser}
 No User exists for *
     + CategoryInfo          : NotSpecified: (No User exists for *:String) [], RemoteException
     + FullyQualifiedErrorId : NativeCommandError
     + PSComputerName        : REMOTECOMPUTER

Remotely Logoff a Specific User

We now need to put these two commands together to allow us to specify a username rather than a session ID to log off a user account. To do that, we need to run quser, filter the output by username and then parse the session ID from that
output sending it to the logoff command.

$scriptBlock = {
     $ErrorActionPreference = 'Stop'
      try {
         ## Find all sessions matching the specified username
         $sessions = quser | Where-Object {$_ -match 'abertram'}
         ## Parse the session IDs from the output
         $sessionIds = ($sessions -split ' +')[2]
         Write-Host "Found $(@($sessionIds).Count) user login(s) on computer."
         ## Loop through each session ID and pass each to the logoff command
         $sessionIds | ForEach-Object {
             Write-Host "Logging off session id [$($_)]..."
             logoff $_
         }
     } catch {
         if ($_.Exception.Message -match 'No user exists') {
             Write-Host "The user is not logged in."
         } else {
             throw $_.Exception.Message
         }
     }
 }
  ## Run the scriptblock's code on the remote computer
 PS> Invoke-Command -ComputerName REMOTECOMPUTER -ScriptBlock $scriptBlock
  Found 1 user login(s) on computer.
 Logging off session id [rdp-tcp#10]...

You can see above when Invoke-Command is running with the scriptblock created, it will detect the user logged in and immediately log them off. Pretty cool! Don’t stop here; read our eBook, «How to Automate Using PowerShell,» for other automation hacks.