Query Session / Qwinsta.exe

Display information about user sessions on a Terminal server or a Remote Desktop Session Host (RD Session Host) server.

      QUERY SESSION [/server:ServerName]
         [/mode] [/flow] [/connect] [/counter]

      QUERY SESSION UserName [/server:ServerName]
         [/mode] [/flow] [/connect] [/counter]

      QUERY SESSION [SessionName | SessionID] [/server:ServerName]
         [/mode] [/flow] [/connect] [/counter]

   UserName    The logon username of the user whose sessions you want to query.

   SessionName The name of the session that you want to query.

   SessionID   The ID of the session that you want to query.

               The Remote Desktop Session Host server to query.
               The default is the current server.

   /mode       Display current line settings.

   /flow       Display current flow-control settings.

   /connect    Display current connect settings.

   /counter    Display current counter information, including the
               total number of sessions created, disconnected, and reconnected.

   /?          Display help.

QUERY SESSION is a synonym for Qwinsta.exe.

Available to 64 bit sessions only, there are no 32 bit implementations of Qwinsta.exe (QUERY SESSION).

A user can always query the session to which the user is currently logged on. To query other sessions, the user must have Query Information special access permission.

If you do not specify a session by using SessionName, UserName, or SessionID, information about all active sessions in the system will be displayed.

When QUERY SESSION returns information, a greater than (>) symbol is displayed before the current session.
Sample output:

C:\>query session
 >console     Administrator1 0  active wdcon
  rdp-tcp#1   User1          1  active wdtshare
  rdp-tcp                    2  listen wdtshare
                             4  idle
                             5  idle

SESSIONNAME The name assigned to the session.
USERNAME The user name of the user connected to the session.
ID The session ID
STATE provides information about the current state of the session.
TYPE indicates the session type.
DEVICE, which is not present for the console or network-connected sessions, is the device name assigned to the session.

Either the SessionName or the ID can be used by the Reset Session and LOGOFF commands respectfully to disconnect or logoff that session from the server.

The comment following session information is from the session profile. Any sessions in which the initial state is configured as DISABLED do not show up in the query session list until they are enabled.

The User Access permission type grants the following special permissions: Query Information, Logon, and Connect. These special permissions allow a user to: Log on to a session on the terminal server. Query information about a session. Send messages to other user sessions. Connect to another session.

Permissions are set under:

Terminal Services Configuration ➞ Connections ➞ Properties ➞ Permissions ➞ Advanced ➞ Permissions


Display information about all active sessions on server64:

C:\> query session /server:Server64

Display information about active session MODEM02:

C:\> query session MODEM02

“Once men are caught up in an event, they cease to be afraid. Only the unknown frightens men” - Antoine de Saint-Exupery

Related commands

Get-CimInstance Win32_LoggedOnUser - Similar to Query Session, but includes stale data (disconnected sessions).
Query Process - Display processes (TS/Remote Desktop).
Query TermServer - List all servers (TS/Remote Desktop).
Query User - Display user sessions (TS/Remote Desktop).
Reset Session - Delete a Remote Desktop Session.
Get-WTSSessionInformation - PowerShell script from Guy Leech to return detailed user session information (RDS & Citrix).
LOGOFF - Log a user off.
CHANGE - Change Terminal Server Session properties.
MSTSC - Terminal Server Connection (Remote Desktop Protocol).

Copyright © 1999-2024 SS64.com
Some rights reserved