PowerShell – Using Query User output as an Object


“Query User” is the perfect tool for administering multi-user systems when you want to see who is currently logged into a system. Open command prompt and type in the command. This command also works even at home when you are the only user of a computer.

Query User

Why is this useful? It’s useful for two reasons: 1) I can see a list of all active users should I need to reboot a system, and 2) I can pull the “ID” to forcibly log off a user by using “logoff <id_number>” from an administrator command prompt.

This post, however, is about how to pull those results and convert them into a powershell object for processing, analysis, and eventual execution.

Here is the full script (note: some of this was pulled from another blog but I was unable to find the source again. I’ll update this post if I can find it):

Function Get-QUser{
    $quserList=@()
     #untested, change (quser) to (quser /server:$computername) if you wanted to extend this into an array of computers
     #you would need to build out the foreach-object loop of computer and specific parameters in the function
    foreach($ServerLine in @(quser) -split "\n") {
        $report = "" | Select-Object UserName, Session, ID, State, IdleTime, LogonTime
        $Parsed_Server = $ServerLine -split '\s+'
        if($Parsed_Server -like "USERNAME*") {continue}
        $report.Username = $Parsed_Server[1]
        $report.Session = $Parsed_Server[2]
        $report.ID = $Parsed_Server[3]
        $report.State = $Parsed_Server[4]
        $report.IdleTime = $Parsed_Server[5]
        $report.LogonTime = $Parsed_Server[6]+" " +$Parsed_Server[7]+" " +$Parsed_Server[8]
        if($Parsed_Server[3] -eq "Disc") {
            $report.Session = "None"
            $report.ID = $Parsed_Server[2]
            $report.State = $Parsed_Server[3]
            $report.IdleTime = $Parsed_Server[4]
            $report.LogonTime = $Parsed_Server[5]+" " +$Parsed_Server[6]+" " +$Parsed_Server[7]
        }
        if($Parsed_Server -like ">*") {
            $Parsed_Server=$Parsed_Server.Replace(">","")
            $report.Username = $Parsed_Server[0]
            $report.Session = $Parsed_Server[1]
            $report.ID = $Parsed_Server[2]
            $report.State = $Parsed_Server[3]
            $report.IdleTime = $Parsed_Server[4]
            $report.LogonTime = $Parsed_Server[5]+" " +$Parsed_Server[6]+" " +$Parsed_Server[7]
        }
        $quserList+=$report
    }
    return $quserList
}

Get-QUser | Format-Table

What’s next?

I needed the above command for a very short need but there was more I wanted to do with this:

  • Group results based on active and inactive
  • Automatically log off all inactive users over a certain time (excellent for pre-patching of chrome, edge, visual studio, etc.). While this can be done with GPO’s, it is sometimes desired to allow long sessions for bulk script processing. However, it would be easy to pull the list of inactive users, verify CPU utilization to determine if any processing is occurring, and then boot inactive session(s) if the results are desirable.
  • Integrated with event log processing to determine total session time for reporting

Additional Links and References

,

%d bloggers like this: