Before restarting a server, performing maintenance, or investigating a security incident, you need to know who is currently logged in. Windows Server provides several ways to see active sessions — both locally and on remote servers. Here is how to check.
Query Sessions from Command Prompt
The fastest method — works on any Windows Server from any Command Prompt:
query sessionOr the equivalent:
qwinstaThis lists all sessions including:
- Session name — console (physical/local login) or rdp-tcp#X (Remote Desktop session)
- Username — the account that is logged in
- State — Active (currently using the session) or Disc (disconnected — the user has disconnected but not logged off, their session is still running)
- Idle time — how long since the session had activity
- Logon time — when the session started
A Disc (disconnected) session is still consuming server resources and will still be interrupted by a restart. Do not assume disconnected users have logged off.
Check Sessions on a Remote Server
query session /server:SERVERNAMEReplace SERVERNAME with the server name or IP address. Requires appropriate permissions on the target server.
Task Manager — Users Tab
On the local server, open Task Manager (Ctrl + Shift + Esc) and click the Users tab. This shows each logged-in user, their session status, CPU, memory, and disk usage per user. Right-click a user to send them a message or disconnect/log off their session.
PowerShell — Get Current Sessions
Get-RDUserSession -ConnectionBroker localhostThis works on servers with the Remote Desktop Session Host role installed. For a simpler approach that works anywhere:
query userThis is similar to query session but shows only user sessions (not system sessions).
Check Sessions via Computer Management
- Open Computer Management (right-click Start → Computer Management)
- Go to System Tools → Shared Folders → Sessions
This shows users connected to shared folders — helpful for seeing who has files open on a file server, not just who has a desktop session.
Sending a Warning Message Before Restart
Once you have identified logged-in users, warn them before restarting:
# Send a message to all sessions
msg * "Server maintenance in 15 minutes. Please save your work and log off."
# Send to a specific user or session
msg USERNAME "Server restarting in 15 minutes — please save your work."The msg command sends a pop-up message to active desktop sessions. It works for local and RDP sessions but requires the Messenger service or remote desktop services to be available.
Logging Off a Stuck or Abandoned Session
If a user has disconnected but not logged off and you need to free the session (or prepare for maintenance):
# Get the session ID from query session output, then:
logoff SESSIONIDOr in Task Manager → Users tab, right-click the user → Log off. Be cautious — logging off an active session closes all the user’s open applications without saving.
Security Note — Unexpected Sessions
If you see sessions for accounts that should not be logged in, treat it as a potential security incident. Check the Security Event Log (Event ID 4624 for successful logins) to see when and from where the login occurred. Unexpected interactive sessions on a server warrant immediate investigation.
