List and Logging Off User Sessions in Windows

Recently I was playing around with Remote Sessions in VMware Horizon View and while trying to reboot a server, I was warned “there are users still logged on”, even though I was certain there were not. Well it turns out I was wrong. But who was still logged on?

Fortunately, there are a number of ways to solicit a user session list. One of the simplest ways is to use Windows built-in DOS commands that allow you to list and logoff user sessions on any machine in your domain.

The DOS commands are QUSER and LOGOFF (quser is short for query user).

These commands work on Windows 7 and higher, and Windows Server 2008 and higher.

You need to have admin privileges in most cases to run these commands.

I found Windows 7 Pro required a registry edit to enable Remote RPC:   (No reboot required)

HKLM\system\currentcontrolset\control\terminal server\AllowRemoteRPC = 1.

Another method is to use the Sysinternals Windows utilities. There is a tool named PSEXEC that can run commands on remote computers, making it possible to use QUSER to list user sessions remotely.

You can also use PowerShell remoting, such as Invoke-Command or Enter-PSSession, to accomplish the same thing.

I am sure there are still other ways to accomplish these tasks, but these are fairly simple utilities that don’t require much investment in time to work with.