如何獲取遠程桌面客戶端的IP地址？

Question

我正在嘗試編寫一個腳本來記錄用戶從中啓動遠程桌面以登錄到Windows Server的Windows客戶端的IP地址。如何捕獲服務器中客戶端的IP地址？

Answer 1

所以，你的使用環境VAR忽略代理...

• ：CLIENTNAME域，你可以解決它回IP

沒有域控制器：使用WMI

• 腳本，你可以到事件日誌，來源：安全性，尋找類別登錄/註銷其中用戶名=環境變量USERNAME

Answer 2

如果您使用的是PowerShell或.NET語言，Cassia library的中繼版本支持此操作 - 只需從build server（以訪客身份登錄並使用工件鏈接）獲取最新版本即可。要打印在本地服務器上所有會話的遠程地址，你可以使用類似以下內容：

ITerminalServicesManager manager = new TerminalServicesManager(); 
foreach (ITerminalServicesSession session in manager.GetLocalServer().GetSessions()) 
{ 
    IPEndPoint ipEndPoint = session.RemoteEndPoint as IPEndPoint; 
    if (ipEndPoint != null) 
    { 
     Console.WriteLine(ipEndPoint.Address); 
    } 
} 

Answer 3

如果你想用「純」 PowerShell 2.0中：

$Wtsapi32 = @' 
using System; 
using System.Text; 
using System.Runtime.InteropServices; 

namespace Wtsapi32 { 

    public enum WTS_INFO_CLASS 
    { 
     WTSInitialProgram, 
     WTSApplicationName, 
     WTSWorkingDirectory, 
     WTSOEMId, 
     WTSSessionId, 
     WTSUserName, 
     WTSWinStationName, 
     WTSDomainName, 
     WTSConnectState, 
     WTSClientBuildNumber, 
     WTSClientName, 
     WTSClientDirectory, 
     WTSClientProductId, 
     WTSClientHardwareId, 
     WTSClientAddress, 
     WTSClientDisplay, 
     WTSClientProtocolType 
    }; 

    [StructLayout(LayoutKind.Sequential)] 
    public struct WTS_CLIENT_ADDRESS 
    { 
     public uint AddressFamily; 
     [MarshalAs(UnmanagedType.ByValArray, SizeConst = 20)] 
     public byte[] Address; 
    } 

    public class PS { 

     public const IntPtr WTS_CURRENT_SERVER_HANDLE = IntPtr.Zero; 
     public const int WTS_CURRENT_SESSION = -1; 

     [DllImport("wtsapi32.dll", EntryPoint="WTSQuerySessionInformation")] 
     public static extern bool WTSQuerySessionInformation(
      System.IntPtr hServer, 
      int sessionId, 
      WTS_INFO_CLASS wtsInfoClass, 
      out System.IntPtr ppBuffer, 
      out uint pBytesReturned); 

     [DllImport("wtsapi32.dll", EntryPoint="WTSFreeMemory")] 
     public static extern void WTSFreeMemory(
      IntPtr memory);   
    } 
} 
'@ 

Add-Type -TypeDefinition $Wtsapi32