Get Remote PowerShell Session Connections

magnifying-glass During a recent PowerShell training class we naturally covered PowerShell remoting. During the discussion I explained that a remote PSSession is essentially transparent to any currently logged on user. Unless of course you reboot the computer! One way you can identify a remote session is by the presence of the wsmprovhost process. You should see this process whenever there is a remote PSSession to the computer. So then the discussion turned to tracking who might have sessions across multiple computers which is especially helpful when dealing with disconnected sessions since you can only see your own sessions. I don’t have a perfect solution, but let’s see if this helps. Here is Get-PSRemoteSession.

This function takes a computername as a parameter. It does a quick ping to verify the computer is running. I probably should have made that optional, but I needed it at the time. The function then queries the computer using Get-CimInstance for all instances of the wsmprovhost.exe process. I’m using CIM because datetime values are automatically formatted which makes it much easier to add a custom property indicating how long the process, and presumably the remote session, have been running. I also add a custom property to get the process Owner. Due to a quirk (bug?) in the CIM cmdlets, I can even query a remote computer running PowerShell 2.0. When using a filter, the CIM cmdlets work with a v2 computer. I won’t question it but will take advantage of it.

By default, the function writes a summary object to the pipeline.

get-psremotesession-1

The one thing I have yet to figure out is a way to show what computer each session is connected from. Although even if I could make the correlation with an active network connection, I’m not sure that would help in the event of a disconnected session. Nor can I tell the state of the session from the process.

I included an option to get the full process object so you could run commands like this:

get-psremotesession-2

But I suspect for many of you the summary will suffice. Here are some examples.

get-psremotesession-3

get-psremotesession-4

get-psremotesession-5

If you kill the wsmprovhost process, that will break the PSSession so be careful. But at least now you have a way of identifying what sessions might be open. I hope you’ll let me know what you think. Enjoy!

6 thoughts on “Get Remote PowerShell Session Connections

    • Good eyes. Probably should have mentioned that. I am using Add-Member to define a new property. But instead of a NoteProperty I am creating a ScriptProperty. The value is the result of a scriptblock. In this context you use $this to indicate the current object in the pipeline. I could have taken extra steps to create my own object and type extension, in which case I would have used this same type of code to define the property, but in an XML file. My script does it all on the fly using Add-Member. So yeah, this is a special case.

      • So, it sounds kind of like $_, but for scriptblocks? I found it searching through about_Automatic_Variables, but the description seems a little vague and hard to wrap my head around.

        Sorry, I know this is a bit off topic for what you were posting; I’d just never seen that one yet.

      • That is kinda correct. But as I said this is a special use case. I may have to write an article on this.

  1. When we use the -Filter the CIM Cmdlets it does work with the machine having PowerShell v2…..So does it fall back to using DCOM when the remote machine doesn’t has winrm configured?
    Just wanted to get little insight on this one…..this bug is helpful šŸ™‚

Comments are closed.