Auditing User Logons

Like application usage auditing, you can use the built-in tools to get you some information to help with capacity planning. One part of capacity planning, after all, is knowing how many people are using an RD Session Host server and how these numbers are increasing over time. That way, you can scale the hardware before users start wondering why the server is slow. It's also helpful to review logon patterns. There is a great deal of process creation associated with establishing a user session. If many users log on to the server at the same time, you might need to adjust the amount of memory available to support this pattern. Starting a process requires two to three times the memory that it takes to keep it running.

It's hard to plan for intense logon periods or increasing numbers of users if you don't know about them. Using the query user command, you can create a rudimentary user auditing tool. To find out how many users have a session open on an RD Session Host server, open the Remote Desktop Services Manager and select the Users tab. All users with sessions will be listed there. You can also get this information by running the following command from a Windows 7 client or a Windows Server 2008 R2 server.

That approach is fine for getting real-time data to help you solve a real-time issue, such as determining if your server is overloaded with user connections and performing poorly. But to get a sense of the average number of users logging onto a server, you will need to compile a user count over time. To get this count over time, you can run query user and pipe the data to a file like this.

NOTE: As demonstrated in the section entitled "Record Application Instances and Email Alerts," you can also count the entries in the text file and append the count to another file so you can see the count increase over time. To see how to count lines in a file and append this count to a log file, refer to the Check-email.vbs script on the companion media.