![Forrest logo](/images/logo.png)
query:tldr:4201e
The "query session" command is used in command prompt or PowerShell to display information about user sessions on a Windows computer. This command retrieves details about all active or disconnected user sessions (also known as terminal sessions or remote desktop sessions) on the local or remote computer.
When executing the "query session" command, it typically returns a table with several columns such as the session name, session ID, username, and state of each session. Here is an example output:
SESSIONNAME USERNAME ID STATE
services 0 Disc console 1 Conn john 2 Disc rdp-tcp 65536 Listen
In the given example, the session "services" with session ID 0 is in a disconnected state, the session "console" with ID 1 is currently connected, the session "john" with ID 2 is disconnected, and the "rdp-tcp" session is in a listening state, waiting for a remote desktop connection.
This command is especially useful for system administrators as it helps identify active user sessions, their states, and who is logged in to the computer at a given time. It can be utilized to troubleshoot connection issues, terminate disconnected sessions, or monitor user activity on a remote machine.