Question:
I’m a PowerShell novice (Bash is my thing normally) who’s currently trying to obtain qwinsta output to show who is logged in as an ‘rdpwd’ (rdesktop) user so that I can check each username against a list of usernames, and if they do not match, log them off.
I am currently working through two problems:
- I am unable to split the qwinsta output to be left with only the username – I’ve tried the “split” function but so far am getting either syntax issues or weird results; one gripe seems to be that ‘\s+’ matches the letter S instead of whitespace; other times I’ve managed to split to the second column, but only output from line 1 appears
- Whilst I’m not there yet, I sense that I will have problems with the second step as well, namely looping through the array of non-log-offable users (which are to be obtained from a local user group)
I’ll focus on problem 1 for now!
The text I’ve got is:
|
1 2 3 4 5 6 7 8 |
SESSIONNAME USERNAME ID STATE TYPE DEVICE services 0 Disc console 1 Conn rdp-tcp#0 user.name1 2 Active rdpwd rdp-tcp#1 user.name2 3 Active rdpwd rdp-tcp#1 user.name3 4 Active rdpwd rdp-tcp 65536 Listen |
The output I want is:
|
1 2 3 4 |
user.name1 user.name2 user.name3 |
(With the aim of then creating a loop that says, in brief terms, “foreach user in list, if not in localgroup, logoff user”.)
So far, I’ve got as far as selecting text with ‘rdpwd’, but using all manner of variations on “split”, I have not got further forward than that.
I’m happy to share what I’ve got already, but alas I don’t think it’ll help anyone!
Any assistance would be most appreciated. 🙂
Answer:
Honestly I’d look up a better way to do this, but you can fudge it with some text manipulation and the ConvertFrom-Csv cmdlet:
|
1 2 |
$(qwinsta.exe) -replace "^[\s>]" , "" -replace "\s+" , "," | ConvertFrom-Csv | select username |
Firstly replace any leading spaces or > characters with nothing, then replace any white spaces with a comma. Then you can pipe to ConvertFrom-Csv and work with the data as an object.
EDIT
Actually, the above has some issues, mostly with the \s+ because if a column is blank it does not get correctly recognised as a blank field, and the next text is incorrectly promoted to the current field.
The below is a full blown parser for this command, and would probably work for any sort of tabulated output from a native windows exe:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 |
$o = @() $op = $(qwinsta.exe) $ma = $op[0] | Select-String "(?:[\s](\w+))" -AllMatches $ErrorActionPreference = "Stop" for($j=1; $j -lt $op.length; $j++) { $i = 0 $obj = new-object pscustomobject while ($i -lt $ma.matches.count) { $prop = $ma.matches[$i].groups[1].value; $substrStart = $ma.matches[$i].index $substrLen = $ma.matches[$i+1].index - $substrStart try { $obj | Add-Member $prop -notepropertyvalue $op[$j].substring($substrStart,$substrLen).trim() } catch [ArgumentOutOfRangeException] { $substrLen = $op[$j].length - $substrStart if($substrLen -gt 0) { $obj | Add-Member $prop -notepropertyvalue $op[$j].substring($substrStart,$substrLen).trim() } else { $obj | Add-Member $prop -notepropertyvalue "" } } $i++ } $o += ,$obj } $o | ? { $_.type -eq 'rdpwd'} | select username USERNAME -------- user.name1 user.name2 user.name3 |