Remote App Session List, App Name

Question

Is there a way to get the name of the RemoteApp a user opened up from the session list and/or event log and/or somewhere else?

When viewing the list of users in Server Manager, we see the users, but we don't see for example if they opened up Calc or Notepad, which we would like to know (for troubleshooting purposes).

Is the name of the App (ID, etc.) written somewhere?

Answer 1

Wow! I didn't even think to look at the client logs. Is there nothing written on the server?

Answer 2

You may use get process command either locally or remotely to check the users running specific programs on the session host servers.

Basic steps could be like:

• Get-RDSessionHost to get a list of RDSH servers in a specific collection
• Get-Process or qprocess.exe to query servers to see which users are running specific program

Result is like:

Reference links:
Get process remotely including username using PowerShell
https://www.powershellbros.com/get-process-remotely-for-user-using-powershell/
Get-Process
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process?view=powershell-6
Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

----------

Hope this helps and please help to accept as Answer if the response is useful.

Thanks,
Jenny

Answer 3

Hi Jenny, I know that , but I was wondering if there is something "built-in". Seems like core functionality which is missing.

Answer 4

Hi,

I did a quick test in my VM and found following two event ID will record remoteapp name and user account around the time I launched the application:

Log Path:
Applications and Services Logs>Microsoft>Windows>RemoteApp and Desktop Connections>Operational
Event ID 1041

Event ID 1040

----------

Hope this helps and please help to accept as Answer if the response is useful.

Thanks,
Jenny