0

enter image description hereWhen I log in into an windows device, I can sometimes see 2 users sessions (I can see it by clicking Task Manager -> Users). One of the users has status Disconnected and the other active

Is there a way for me to see weather the user is disconnected or not in the registry?

Thank you

Yiftach Cohen
  • 39
  • 1
  • 4
  • 2
    Why are you so specifically thinking the *registry* must be involved in determining this? – Damien_The_Unbeliever May 26 '22 at 07:02
  • I don't know. But I have mechanism which checks users info via remote registry so I want to use it for that if possible – Yiftach Cohen May 26 '22 at 08:58
  • 2
    A user can be signed in multiple times, some connected and some disconnected. So the answer to "Is the user connected or disconnected" could be "Yes". The registry is not an API. The WTSEnumerateSessionsExW API gives you the sessions, including the user and the session state, and it can tell you "Oh, that user is signed in twice, once connected and once disconnected." – Raymond Chen May 26 '22 at 14:26

1 Answers1

2

I don't know if there is a registry value you can check and if you find one it must be considered an unintended side effect you should not rely on.

The WTS API is the correct way to handle this.

Call WTSRegisterSessionNotification to receive notifications and/or WTSEnumerateSessionsW to find the current sessions and their states.

Anders
  • 97,548
  • 12
  • 110
  • 164
  • This answer lead me down the right direction.... I found [this PowerShell script](https://www.reddit.com/r/PowerShell/comments/306mcn/wtsenumeratesessions/). Also another useful collection of answers https://stackoverflow.com/q/32177668/3196753 – tresf Dec 14 '22 at 21:01