Overview
The RDPSessions command enumerates active Remote Desktop Protocol (RDP) sessions on the system. This identifies who is currently connected via RDP, their session state, and connection details - valuable for understanding concurrent access and potential lateral movement paths.Syntax
Remote Execution
Output
Returns RDP session information:- Session ID
- Username
- Session state (Active, Disconnected)
- Session type (Console, RDP-Tcp)
- Client name/IP address
- Logon time
Use Cases
- Red Team
- Blue Team
- Identify active admin sessions for token theft
- Discover other connected users
- Plan session hijacking attacks
- Identify concurrent access for stealth
- Find disconnected sessions to hijack
Example Output
Remote Execution
This command supports remote execution using the
-computername parameter.Detection Considerations
- API Calls: Uses WTSEnumerateSessions and WTSQuerySessionInformation
- Privilege Requirements: May require elevated privileges
- WMI Activity: Remote execution generates WMI events
Related Commands
- RDPsettings - RDP configuration settings
- LogonSessions - All logon sessions
- LocalUsers - Local user accounts
- NetworkProfiles - Network connections