That is just too many steps involved and there got to be a better way to handle this if I want to monitor all incoming remote sessions on a regular consistent basis. Time to ask PowerShell for help.

You can use Get-WmiObject cmdlet to query the Win32_TSGatewayConnection class for live session data on the Gateway server. Like this:

Get-WmiObject -class "Win32_TSGatewayConnection" -namespace "root\cimv2\TerminalServices" -ComputerName remote_server -Authentication 6

To get the geolocation info, you can call up Invoke-RestMethod cmdlet that deals with HTTP/HTTPs requests related to Representational State Transfer (REST) web services that return richly structured data, such as XML or JSON. It’s a perfect candidate to perform the call and display the result in a nicely formatted way. It runs something like this:

Invoke-RestMethod -Uri "http://ipinfo.io/$ipaddress"

For more information about getting Geolocation info from PowerShell, check out this post.

Putting together, here is the code you can use to get all live sessions’ IP addresses and their geolocation info on the Remote Gateway server.

$ts = Get-WmiObject -class "Win32_TSGatewayConnection" -namespace "root\cimv2\TerminalServices" -ComputerName remote_server -Authentication 6
$ofs = "`r`n`r`n"
$body = "Gateway connections: " + $ofs

foreach ($connection in $ts)
{
    $username = $connection.username
    $ip = $connection.clientaddress
    $geo = Invoke-RestMethod -Uri "http://ipinfo.io/$ip"
    $body = $body + $connection.ConnectedTime + $username + $geo + $ofs
} 
$body

It works great to get data from the live sessions. What about the closed sessions that you missed? You can create a scheduled task that triggers a PowerShell script every time a session goes live. The trigger needs to be based on the event, more specifically, Microsoft-Windows-TerminalServices-Gateway/Operational. See the trigger below:

The script will then collect the IP info of that session and save it to the event log.

$ts = Get-WmiObject -class "Win32_TSGatewayConnection" -namespace "root\cimv2\TerminalServices" -ComputerName Remote_Server -Authentication 6  | Sort-Object ConnectionDuration -Desc
$ofs = "`r`n`r`n"
$body = "Gateway connections: " + $ofs

foreach ($connection in $ts)
{
    $username = $connection.username
    $ip = $connection.clientaddress
    $geo = Invoke-RestMethod -Uri "http://ipinfo.io/$ip"
} 

$body = $body + $connection.ConnectedTime + ": " +$username + $geo + $ofs

$server = "remote_server"
$logname = "application"
#New-EventLog -ComputerName $server -Logname $logname -Source "MyApp"
Write-EventLog -ComputerName $server -Logname $logname -Source "MyApp" -EventID 3001 -Message $body

Note that the script only extracts the last session from the session collection so only the newest info will be saved into the log. Once the data is saved in the event log, I can run another PowerShell script to collect and send them to me via email. And I can schedule that script to run on a daily basis.

Your roaming user profile was not completely synchronized. See the event log for details or contact administrator.

By checking the event log, a few warning entries show that

Windows cannot copy file \\?\C:\Users\131\System Volume Information to location \\?\UNC\backup\mcq\profiles\tsProfiles\131.V2\System Volume Information. This error may be caused by network problems or insufficient security rights.

So why a user profile has a folder called System Volume Information that is only made for a storage volume? That’s because I am using User Profile Disk for the Remote Desktop sessions. Each session has its own disk mounted to store the user profile data. And because it’s basically a disk, it has a system hidden folder called System Volume Information only accessible by the operating system.

The only way to get around it is to exclude this folder from roaming profile. You can do that through Group Policy.

Open Group Policy Management Policy, go to

User Configuration > Administrative Templates > System > User Profiles

Double click Exclude directories in roaming profile setting.

Click Enable, and type in the folder names, separated by semi-colons.

Click OK when done and that will do the trick next time when you log in and log off.

If you have a lot of users using RDS with UPD enabled, there will be a lot of individual UDP files stored on the file share, named with the unique GUID of the AD user, like below:

So, how to identify which UPD disk belongs to which user account?

You can use the following PowerShell cmdlet to find out the user based on the GUID.

Get-ADUser -fileter {SID - like "GUID"}

Or, find out the GUID based on the user account ID.

Get-ADUser -filter {SamAccountName -like "UserID"}

Or, even better, use this little portable standalone tool called Sidder to help you to quickly identify which UDP belongs to which AD user. You will need .Net 4.5 Framework to use this tool.

The ones in orange are the ones that are in use at the moment. The tool also allows you to delete UPD as well. Deleting UPD will result in a fresh start for that user next time when they log in.