What API will allow me to detect and end the session of someone using "mstsc /console"?

Question

I'm having a very difficult time listing and closing the sessions of folks using Mstsc /admin.

Does anyone know the API to use if the server is a normal server and not a terminal server per-se?

Answer 1

You can use the LsaEnumerateLogonSessions function to get a list of all logged in sessions, and use LsaGetLoginSessionData to determine what type of session it is.

If you're only interested in remote desktop sessions, WTSEnumerateSessions might be helpful as well. If you'd like to force a logoff, you can use WTSLogoffSession.

Answer 2

You can start with WTSEnumerateSessions or WTSEnumerateSessionsEx.