[This month’s SAPIEN newsletter offered this one liner I thought I’d share with the rest of you].<\/p>\n
The following one line PowerShell expression should show you who is logged on to a specific server and desktop and for how long. Most logon sessions use a single instance of Explorer.exe, although it is possible for a user to manually start additional instances of Explorer.exe.<\/p>\n
Get-WmiObject win32_process -filter \"name='explorer.exe'\" -computer \"SERVER01\"\u00a0 | This should give you output like this: Computer\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : SERVER01 <\/tt>
\nselect @{name=\"Computer\";Expression={$_.CSNAME}},@{Name=\"Owner\";Expression={
\n\"{0}\\{1}\" -f $_.getOwner().Domain,$_.getOwner().User}},
\n@{name=\"Started\";Expression={$_.ConvertToDateTime($_.creationdate)}},
\n@{name=\"Duration\";Expression={
\n$started=$_.ConvertToDateTime($_.creationdate)
\n$now=Get-Date
\n($now-$started).toString()}},
\n@{name=\"KernelModeTime(s)\";Expression={$_.KernelModeTime\/10000000}},
\n@{name=\"UserModeTime(s)\";Expression={$_.UserModeTime\/10000000}}<\/tt>
\n<\/span><\/p>\n
\n<\/tt><\/p>\n
\nOwner\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : MyCompany\\Jeff
\nStarted\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 10\/20\/2008 9:01:38 AM
\nDuration\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 1.05:47:58.8702700
\nKernelModeTime(s) : 123.8179937
\nUserModeTime(s)\u00a0\u00a0 : 51.9795332<\/span><\/tt><\/p>\n
\nThe KernelMode and UserMode times are in seconds. Because this is an object, you can pipe it to other cmdlets to sort, filter, export or convert. If you have comments or questions about this or anything else PowerShell, please visit the forums at ScriptingAnswers.com<\/a>.<\/p>\n