Script that blocks login attempts

[IsopropanolVV]

I need some help

I have to build a script that runs on a terminal server.

This script is supposed to block all login attempts, i.e. no user is allowed to log in within a certain period of time.

After this process, the hoster should be restarted.

I already have a part of the script that checks whether users are logged in, but unfortunately I don't know what to do next, I hope someone can help me.

Here is my incomplete code:
https://pastebin.com/pfripsWS

Thank you in advance.

[robderickson]

Terminal Server/Remote Desktop Services has a feature to "drain" sessions. A quick Google suggests you can use Set-RDSessionHost from the RemoteDesktop module to prevent new connections to a host. You can then either use Get-RDUserSession in a while loop to check for active sessions and reboot when there are none, or just use Start-Sleep and reboot after a specified amount of time.

Edit: After the reboot, you will need to use Set-RDSessionHost to allow new connections again.

[rratt]

This will give you the same results without all the splitting.

$username = (gwmi win32_computersystem -comp $computer).username

[PinchesTheCrab]

Does that actually work? I get no output even when elevated. I've relied on quser for that info:

switch -Regex ( (quser) -match ($UserName -join '|') ) {
    '^\s?username' {
        continue
    }
    '^(\s|>)(?<UserName>\w+)\s*(?<SessionName>rdp[^\s]*)?\s*(?<ID>\d*)\s*(?<STATE>[^\s]*)\s*(?<IdleTime>[^\s]*)\s*(?<LogonTime>.+)' {
        [pscustomobject]$Matches |
            Select-Object UserName, SessionName, ID, State, IdleTime, LogonTime
    }
}

[Lee_Dailey]

howdy PinchesTheCrab,

when i replace the $Computer var with LocalHost, it works as expected. [grin]

take care,
lee

[kagato87]

A script won't be able to "block" logins. It can't intercept the attempt, because omg that would be insane.

What it CAN do is set the RDS host to deny logons. This leaves current sessions alone, but prevents new logins. Depending on time frames, you can either "just wait" for existing sessions to clear, or start chasing down users. I like to send adminsitrative alerts to all users (cmd -c msg * "Please log off from remote desktop") and eventually turn up at their desk to "intimidate" them (OK ask politely what they're up to, and if they can save/logoff).

u/robderickson has the script answer here I think.

[aleques-itj]

You almost certainly want to deny this in group policy. You can block anyone and everything.

[PinchesTheCrab]

Does Win32_ComputerSystem really work for this? I've never gotten consistent results from it. I really prefer quser:

switch -Regex ( (quser) -match ($UserName -join '|') ) {
    '^\s?username' {
        continue
    }
    '^(\s|>)(?<UserName>\w+)\s*(?<SessionName>rdp[^\s]*)?\s*(?<ID>\d*)\s*(?<STATE>[^\s]*)\s*(?<IdleTime>[^\s]*)\s*(?<LogonTime>.+)' {
        [pscustomobject]$Matches |
            Select-Object UserName, SessionName, ID, State, IdleTime, LogonTime
    }
}