title: View RDP connections and identify what one is using /admin
body: <p>Ok, I have ran into a bit of a stump... I wanted to find out what session is using the /admin or aka console session on a system. I tried query session and qwinsta but I cannot seem to ID this task. Anyone have any pointers or suggestions on how I would achieve this?</p>
  
  <p>What I ultimately want to do is prevent any rdp sessions that are not /admin connections.</p>
  
  <p>Below are some samples that I have done via command line.</p>
  
  <pre><code>PS C:\Users\userid&gt; qwinsta
   SESSIONNAME       USERNAME                 ID  STATE   TYPE        DEVICE
   services                                    0  Disc
   console                                     1  Conn
   rdp-tcp#0         userid2                   2  Active  rdpwd
  &gt;rdp-tcp#1         userid                  3  Active  rdpwd
   rdp-tcp                                 65536  Listen
  
  PS C:\Users\ userid &gt; query session /mode
  SESSIONNAME       STATE   DEVICE    TYPE             BAUD  PARITY  DATA  STOP
   services          Disc                                      none             1
   console           Conn                                     none             1
   rdp-tcp#0         Active            rdpwd                  none             1
  &gt;rdp-tcp#1         Active            rdpwd                  none             1
   rdp-tcp           Listen                                   none             1
  
  PS C:\Users\ userid &gt; query session /connect
   SESSIONNAME       STATE   DEVICE    TYPE           CONNECT
   services          Disc                             cts
   console           Conn                             cts
   rdp-tcp#0         Active            rdpwd          cts
  &gt;rdp-tcp#1         Active            rdpwd          cts
   rdp-tcp           Listen                           cts
  
  PS C:\Users\ userid &gt;
  </code></pre>
  
  <p>*Note rdp-tcp#1 is currently using the /admin switch in the mstsc session.</p>
  
  <p>*Note ">" indicates the current session I am running the command as</p>