How to Use the query user and query session Commands in Windows to Audit Logged-On Users

In multi-user computing environments, Windows Server systems, and Remote Desktop (RDP) session hosts, system administrators must frequently audit which accounts are actively logged on, determine their connection state, check idle times, and identify session IDs for administrative disconnection or messaging. Windows provides two command-line utilities for this purpose: query user and query session. Available directly from Command Prompt and PowerShell, these commands provide real-time visibility into active and disconnected user sessions without opening graphical administrative consoles.

Understanding query user vs query session

While both utilities query the Windows Remote Desktop Services and Session Manager subsystems, they present data from complementary perspectives:

Command	Primary Focus	Key Information Returned
query user	User Accounts	Username, session name, session ID, connection state (Active/Disconnected), idle time, and initial logon timestamp.
query session	Session Slots & Endpoints	Session names (console, rdp-tcp#), usernames, session IDs, execution states, and underlying device types.

Auditing Logged-On Users with query user

To inspect all currently logged-on users on the local machine:

1. Open Command Prompt or PowerShell (running as Administrator is recommended for complete multi-user audits).
2. Type the following command and press Enter:

   query user

3. Windows outputs a formatted table similar to the following:

    USERNAME              SESSIONNAME        ID  STATE    IDLE TIME  LOGON TIME
   >administrator         console             1  Active        none  15/10/2026 08:30
    jsmith                rdp-tcp#4           2  Active          12  15/10/2026 09:15
    mwilson                                   3  Disc          1:45  15/10/2026 07:00

Reading the Output: The greater-than symbol (>) indicates your currently active session. Accounts listed with Disc under STATE are disconnected sessions where user applications remain running in memory, consuming RAM and CPU resources.

Targeting Specific Accounts or Remote Servers

You can target specific individual usernames or query remote network hosts directly across your local network or Active Directory domain:

• Query a Specific User: Filter results for a single account name:

  query user jsmith

• Query a Remote Machine: Use the /server switch to audit remote hosts across the network:

  query user /server:APP-SERVER-02

Inspecting Session Endpoints with query session

If you need to view all active listener endpoints and determine whether Remote Desktop is actively accepting inbound connections, run:

query session

 SESSIONNAME       USERNAME                 ID  STATE    TYPE        DEVICE
 services                                    0  Disc
 console           administrator             1  Active
 rdp-tcp                                 65536  Listen
 rdp-tcp#4         jsmith                    2  Active   rdpwd

The entry labeled rdp-tcp with the state Listen confirms that the Remote Desktop Service listener is running and ready to accept incoming RDP traffic.

Practical Administrative Actions Using Session IDs

Once you have identified a user’s numerical Session ID (e.g. ID 3 for disconnected user mwilson), you can perform targeted management actions from the same console:

1. Log Off a Stuck Session: Terminate an unresponsive or disconnected session to reclaim memory:

   logoff 3

2. Send a Pop-Up Alert to a Session: Broadcast a message warning the user prior to server maintenance:

   msg 2 Server rebooting in 10 minutes. Please save your work.

3. Reset an RDP Connection: Clear a frozen terminal socket:

   reset session 2