NOTE: Updated November 2016 to include -ServersToQuery and -StartTime and parameters.
e.g.
.\RDPConnectionParser.ps1 -ServersToQuery Server1, Server2 -StartTime "November 1"
————————–
Hey everyone, yes I’m still alive!
Connection Report for Remote Desktop
I wrote a script that connects to one or multiple servers and captures Remote Desktop logons, disconnects, reconnects and logoffs along with the connecting IP:
Feb 2021 Edit:
Microsoft finally took down the TechNet Gallery. This script is now available on GitHub: https://github.com/Mike-Crowley/Public-Scripts/blob/main/RDPConnectionParser.ps1
Download RDPConnectionParser.ps1 here
Recipient Address Report (Formally ProxyAddressCount)
I also updated the “Exchange Proxy Address (alias) Report” script. It now includes a few environment metrics, as well as the regular CSV-style output:
Download the updated script here
Feb 2021 Edit:
Microsoft finally took down the TechNet Gallery. This script is now available on GitHub: https://github.com/Mike-Crowley/Public-Scripts/blob/main/RecipientReportv5.ps1
Mike Crowley's Whiteboard 
A friend has enabled RDP to his home computers thru port forwarding on his router. I’d like him to see if rogue RDP logon attempts have failed on his Windows 7 & 8 home computers. Can your script be run on a Windows 7 or 8 host to make a quick report of failed RDP login attempts?
I think it should work on Win7, but I haven’t tested it. In that same log, look for event 1012. It will state “remote session from client name exceeded the maximum failed logon attempts” or something like that, but I don’t believe it records the IP if a session isn’t successful. I would suggest your friend configure RDP on an alternate port, as exposing 3389 to the internet is a big risk, especially since Win7 doesn’t lock out accounts by default.
Dear Mike,
I am new to learn to PowerShell , how do i run on my windows server 2016. could you please send me the steps to run windows server 2016.
Mike,
I want to monitor the sessions getting created on my RD Server. Want to see when my employees logged in and logged out. Will the script be able to capture the information? Could you please guide something?
Regards,
The script does report the information you’re looking for, but it would need to schedule it to run regularly. You could also attach triggers to the event viewer,
How would you modify this to read the Microsoft-Windows-TerminalServices-Gateway/Operational log? I’m not a programmer but I substituted “Gateway” for “LocalSessionManager” but no results. Thanks!
Hi Jim, I don’t have a RD Gateway server handy to test with, but the script pulls out entries with certain event IDs (21, 23, 24, 25). Unless the gateway log creates the exact same event IDs, you’d need to make more changes to the $LogFilter section. This is a great resource for parsing the event log XML data. Check it out: http://blogs.technet.com/b/ashleymcglone/archive/2013/08/28/powershell-get-winevent-xml-madness-getting-details-from-event-logs.aspx
Thanks so much! I just made it work by using the xml specific to the gateway. I suppose it would be too simple to have a consistent naming convention…
Hi Mike. Thanks for the post, this is a great script. I ran this script with two different accounts that are part of the administrators group, but the outcome showed different results for each account. This is the only error I got:
Get-WinEvent : The RPC server is unavailable
At H:\Company Shared Folders\..\RDPConnectionParser.ps1:30 char:19
+ $AllEntries = Get-WinEvent -FilterHashtable $LogFilter -ComputerName $Server
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-WinEvent], EventLogException
+ FullyQualifiedErrorId : System.Diagnostics.Eventing.Reader.EventLogException,Microsoft.PowerShell.Commands.GetWi
nEventCommand
Do you know if there is a specific firewall rule I need to enable on the remote RDS servers?
And it looks like my first comment got lost as well while logging into Google+, so here it is again (sorry to bother you if I posted this more than one time):
Thanks Mike! The RDP Connection sript is working like a charm! That saved me a lot of headaches, to easily get a simple but informative summary of RDP-sessions.
By the way, it isn’t very wide spread, but I have got some information and a little batch s
Hi Mike, love this.
Is there a way to limit to the last 30 days?
Is there a way to just go to OU=Servers, and run on all there instead of inputting a few at a time?
Hey Mike
thanks, thanks, thanks
for me you deserve an statue! and really deserve it with an engraving with the tittle “most valued” professional.
I’ve spent hours on the internet hammering my head to get the IP adresses of users on my RDP!
I got dozens of answers of installing (and purchasing) software, modify the GPO, enable logs, but for the sake of simplicity, how is that the servers logs so many (junk) varied registers, but cannot have the IP of the guy entering my server!
and you have made it straightforward and easy.
with all my emotion
again thanks, thanks, thanks
Blessings for you!
Hi,
I’m using the RDPConnectionParser.ps1 to notify me of all RDP logon/logoff activity for a specific user. I have noticed that there are many logon,disconnected, and reconnection in a short time span. I’m wondering if the user is actually performing this many logon and logoff actions or if maybe I’m misreading the report. Below is a sample.
“11/6/2018 8:50:47 AM”,”ABC-SERVER\abcuser”,”localhost”,”IPAddress123″,”logon”
“11/6/2018 9:02:38 AM”,”ABC-SERVER\abcuser”,”localhost”,”IPAddress123″,”disconnected”
“11/6/2018 9:03:02 AM”,”ABC-SERVER\abcuser”,”localhost”,”IPAddress123″,”reconnection”
“11/6/2018 9:28:25 AM”,”ABC-SERVER\abcuser”,”localhost”,”IPAddress123″,”disconnected”
“11/6/2018 11:49:34 AM”,”ABC-SERVER\abcuser”,”localhost”,”IPAddressXYZ”,”reconnection”
“11/6/2018 12:05:02 PM”,”ABC-SERVER\abcuser”,”localhost”,”IPAddressXYZ”,”disconnected”
“11/6/2018 12:06:29 PM”,”ABC-SERVER\abcuser”,”localhost”,”IPAddressXYZ”,”reconnection”
“11/6/2018 12:22:59 PM”,”ABC-SERVER\abcuser”,”localhost”,”IPAddressXYZ”,”disconnected”
“11/6/2018 12:24:01 PM”,”ABC-SERVER\abcuser”,”localhost”,”IPAddressXYZ”,”reconnection”
“11/6/2018 12:29:34 PM”,”ABC-SERVER\abcuser”,”localhost”,”IPAddressXYZ”,”disconnected”
“11/6/2018 12:30:18 PM”,”ABC-SERVER\abcuser”,”localhost”,”IPAddressXYZ”,”reconnection”
“11/6/2018 12:39:08 PM”,”ABC-SERVER\abcuser”,”localhost”,”IPAddressXYZ”,”disconnected”
You can review the event log yourself (eventvwr) to confirm. The script simply pulls from there. It could be a client with an unreliable network connection, but more context and investigation would be necessary.
First, I would like to say thank you for putting this together. This gives me a quick idea of how many people I have logging into the RDS servers.
Can I suggest adding event ids 41 and 42 for clustered rds servers?
if ($_.EventID -eq ’41’){“Begin Session”}
if ($_.EventID -eq ’42’){“End Session”}
At row 65
I am not sure how to grab the cluster name but if you can grab that and add it to the export I think it would be helpful as well.
Thank you so much for this script. It is exactly what I was looking for. When running the script using : ./RDPConnectionParser.ps1 -ServersToQuery ServerName -StartTime “February 2, 2019”
I only get the results of the current day (4 Feb)
Have you verified the data is actually in the log? Perhaps it was cleared, or the log rolled over. Does the data appear when you do not use the -StartTime parameter?
Hi, thank you very much for RDPConnectionParser – great work 🙂 Since i am using Linux-Servers in most cases, i would like to export the results of RDPConnectionParser in a MySQL Database. Do you have a hint how to do this?
Hi, thank you very much for RDPConnectionParser – great work 🙂 Since i am using Linux-Servers in most cases, i would like to export the results of RDPConnectionParser in a MySQL Database. Do you have a hint how to do this?
Does this script work on Windows 10?
I think so.
Massive thank you for this. Has really saved me a lot of time and effort!
this script “Connection Report for Remote Desktop” is useful, but one improvement is needed:
it doesn’t support Unicode usernames or PC names when writes into the output file. Can you make such edit please?
Hello 🙂
How would I modify the ‘StartTime’ parameter to increment by a day? I don’t have the StartTime variable in my batch file, but it will only pull back the day specified and so I need to have it so that the scheduled task pulls back the correct days logs each day, until specified otherwise :).
Thanks!
Hi Mike,
Thanks for the script, its awesome!
I’m looking to make an admentment so I can use it with a scheduled task to pull back the days logon/logoff stats for each day that it is running. Is there a way of substituting the value of -StartTime to be something like ‘Get-Date’ to pull back the relevant results?
Thanks! Dan
Yes, starttime is just looking for a datetime object, so you can do ((get-date).adddays(-7)) or whatever
Hi Mike,
Thanks for your response :).
So does that mean that the ‘-7’ is acting as a count down? So if I wanted to get it to run for 180 days, for example, daily (in line with the scheduled task), I would use -180?
Thanks, Dan
By default, this script gets all of the available events in the event log. If you’d like to only get the last 7 days, for example, you can specify a start date of (now minus 7 days). You can change the number obviously. More info here: https://devblogs.microsoft.com/scripting/adding-and-subtracting-dates-with-powershell/
Say, for example, I’ve got an image file of a drive and I mount the image as drive letters. How can I run this on the mounted drive?
Hi Mike,
I cannot download the script anymore, is it still available somewhere?
Mark
I’ll publish it to GitHub, but for now, please email me.
https://github.com/Mike-Crowley/Public-Scripts/blob/main/RDPConnectionParser.ps1
The link to technet is broken.
https://github.com/Mike-Crowley/Public-Scripts/blob/main/RDPConnectionParser.ps1
&
https://github.com/Mike-Crowley/Public-Scripts/blob/main/RecipientReportv5.ps1
Hi, the link is not valid anymore, to you have this script for me?
Thanks in advance!
https://github.com/Mike-Crowley/Public-Scripts/blob/main/RDPConnectionParser.ps1
&
https://github.com/Mike-Crowley/Public-Scripts/blob/main/RecipientReportv5.ps1