How to Use the query session and query user Commands in Windows 11 to Audit Active Remote Desktop Sessions

When administering Windows 11 workstations, remote support hosts, or shared development jump boxes, tracking logged-in user sessions is essential for both operational maintenance and security audits. Multiple users or background services may remain logged into terminal sessions, locking shared software licences, consuming physical memory, or leaving remote desktop channels exposed in a disconnected state.

While Task Manager displays logged-in users under its Users tab, it lacks scriptable detail and fails to expose underlying Remote Desktop Session Host (RDSH) session IDs and protocol states. Windows 11 includes two lightweight, native command-line auditing tools: query session and query user. This guide demonstrates how to inspect active sessions, identify idle RDP connections, and integrate session audits into administrative scripts.

Understanding Session Architecture in Windows

Every interactive or remote connection to Windows is assigned a discrete session context:

• Session 0: The isolated non-interactive session reserved exclusively for operating system services and background daemons.
• Console Session: The physical display, keyboard, and mouse attached directly to the local hardware monitor.
• RDP-Tcp Sessions: Dynamic network sessions created when remote users connect via Remote Desktop Protocol (mstsc).
• Session States: Include Active (user actively interacting), Disc (disconnected but preserving running processes), and Listen (socket listening for inbound connections).

Syntax and Options for query session

The query session utility (also accessible via its legacy alias qwinsta) queries terminal server sessions across local or remote machines:

query session [SessionName | UserName | SessionId] [/server:ServerName] [/mode] [/flow] [/connect] [/counter]

Key Parameters

• SessionName: Filters output to a specific session name (e.g. console or rdp-tcp#1).
• /server:ServerName: Targets a remote network server or workstation rather than localhost.
• /mode: Displays line setup and baud rate parameters for COM port sessions.

Step-by-Step Practical Inspection Examples

1. Inspecting All Local Sessions

Open Command Prompt or PowerShell with administrative privileges and execute:

query session

Sample output:

 SESSIONNAME       USERNAME                 ID  STATE    TYPE        DEVICE
 services                                    0  Disc
>console           Administrator             1  Active
 rdp-tcp#0         DevEngineer               2  Active   rdpwd
 rdp-tcp                                 65536  Listen

In this output, the > character denotes your currently active command session. Session 2 (DevEngineer) is actively connected over RDP, while session rdp-tcp ID 65536 is the listener awaiting incoming network handshakes.

2. Filtering Logged-In Users with query user

To view detailed user logon timestamps and idle durations rather than raw session pipes, use query user (alias quser):

query user

Sample output:

 USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
 Administrator         console             1  Active          .  17/10/2026 08:30
 DevEngineer           rdp-tcp#0           2  Disc        02:15  17/10/2026 09:12

Here, DevEngineer has disconnected their RDP client but left their session alive; the session has been idle for 2 hours and 15 minutes, holding allocated RAM.

3. Terminating Disconnected Orphan Sessions

If an idle or hung session must be closed to free system resources, combine the discovered Session ID with the native reset session (or rwinsta) command:

# Terminate disconnected session ID 2
reset session 2

Comparison of Windows Session Management Commands

Command	Primary Output Focus	Administrative Use Case
query session	Session names, hardware devices, and protocol states	Auditing active listener sockets and RDP pipeline status
query user	Usernames, logon times, and elapsed idle duration	Identifying inactive users holding system memory
reset session	Immediate termination of target session ID	Clearing hung or disconnected terminal sessions without rebooting
logoff	Graceful user logoff request	Allowing applications to cleanly close before ending session

Troubleshooting Remote Query Failures

• Access Denied (Error 5): When querying a remote machine with /server:TargetHost, ensure your credentials have administrative rights and that Remote Procedure Call (RPC) firewall rules are enabled on the target.
• No Session Exists for User: If querying a specific user who has no active logon token, query user returns exit code 1. Handle this exit code appropriately in automated scripts.