How to Remotely Log Off User with Command Line?

6.3K

A Windows administrator can use the logoff command to log off a user session remotely from any Windows computer in the network. In this article, we’ll show how to get a list of sessions on a remote computer using the quser command and end the user session with logoff.

Using Command Prompt to Remotely Logoff Users

You can remotely log off local console sessions, Remote Desktop (RDP) sessions, and Remote Desktop Services (RDS) sessions using built-in Windows tools.

Before killing a user’s session in Windows, you need to get the user’s session ID. You can list sessions on the remote computer using the built-in quser console tool. Open a command prompt as an administrator and run the command:

quser /server:server_name

The quser command will list all sessions on the remote host, including the console session (SESSIONNAME=Console) and RDP user sessions (SESSIONNAME=rdp-tcp#X).

Find the user in the list whose session you want to end. For example, we want to logoff the administrator session with the ID = 2.

To end a user session remotely, use the following command:

Logoff sessionID /server:ComputerName

In our example, this is:

Logoff 2 /server:server_name

Check that the user session has ended:

quser /server:server_name

If you want to log off a specific user by username, use the following PowerShell script:

$server = 'dc02'
$username = 'administrator'

$query = query user /server:$server 2>$null

$sessionLine = $query | Where-Object {
    $_ -match "^\s*>?$username\s+"
}

foreach ($line in $sessionLine) {
    if ($line -match '^\s*>?\s*\S+(?:\s+\S+)?\s+(\d+)\s+') {
        $sessionId = $matches[1]

        logoff $sessionId /server:$server
    }
}

The query user command returns formatted text output rather than structured objects. Scripts that parse this output should account for different session formats, including disconnected RDP sessions where the SESSIONNAME field may be empty.

If multiple sessions exist for the same user account, the script may return multiple session IDs. You should review the output and adjust the script if you need to handle multiple concurrent sessions.

Notes

• To connect to a remote computer server_name, your account must be a member of the local Administrator group.
• You can also use the qwinsta command to get a list of user sessions on a remote computer:
  qwinsta /server:server_name

Possible errors when executing the logoff command

Could not logoff session ID 2, Error code 5

Error [5]:Access is denied.

This usually indicates insufficient permissions to manage the target session. You need to make sure you are running an elevated Command Prompt/PowerShell session and that your account has admin rights on the remote machine.

Error 0x00000005 enumerating sessionnames

Error [5]:Access is denied.

You are running the logoff command under a local user with administrator privileges. For such users, the Remote UAC policy is enabled by default. To disable UAC remote restrictions for local users, create the LocalAccountTokenFilterPolicy registry parameter on the target host with a value of 1.

reg add "\\server_name\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

Error 0x000006BA enumerating sessionnames

Error [1722]: The RPC server is unavailable.
Enable RemoteRPC on the remote machine server_name:

reg add "\\server_name\HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v AllowRemoteRPC /t Reg_Dword /d 0x1 /f

In addition, note that Windows Firewall must allow RPC traffic and Remote Desktop Services management connections.

Logoff Remote Desktop Services Users Using PowerShell

You can use the command prompt to remotely log off user sessions on Windows Server hosts with Remote Desktop Services (RDS) deployed. An RDS server can have multiple user sessions active at the same time.

If you plan to put the RDShost into maintenance mode or install updates, you need to logoff all user sessions remotely. To do this, you first need to put the RDS host in the Drain mode (in this mode, the RDS host blocks new user logons):

Invoke-Command -ComputerName NYRDS1 -ScriptBlock {
cmd.exe /c "change logon /drain"
}

Now you can end all sessions remotely using a PowerShell script:

$Server = 'rds01'
try {
    $query = query user /server:$Server 2>$null
    foreach ($line in $query | Select-Object -Skip 1) {
        if ($line -match '^\s*\S+(?:\s+\S+)?\s+(\d+)\s+') {
            $sessionId = $matches[1]
            logoff $sessionId /server:$Server /V
        }
    }
}
catch {
    Write-Warning $_.Exception.Message
}

Or, you can only logoff RDS user sessions in a disconnected state:

$Server = 'rds01'
$query = query user /server:$Server 2>$null

foreach ($line in $query | Select-Object -Skip 1) {
    if ($line -match '^\s*\S+(?:\s+\S+)?\s+(\d+)\s+(Disc)\s+') {
        $sessionId = $matches[1]

        logoff $sessionId /server:$Server /V
    }
}

Warning. Logging off a session forcibly terminates user processes and may result in unsaved work being lost. You should notify users before ending active sessions.