How to force a user logoff remotely with PowerShell

Here is the final revised functional script that is being used at my company. I found a PC today with 16 users currently logged on!!! The script contains a loop so you can logoff more than one person on the targeted PC:

cls
Write-Host '******************************'
Write-Host '* Log Off User Remotely *'
Write-Host '******************************'
Write-Host

$global:adminCreds = $host.ui.PromptForCredential("Need credentials", "Please enter your user name and password.", "", "")
$global:ComputerName = Read-Host 'Computer Name?'
Function getSessions {
Write-host
Write-host "Getting user sessions..."
Write-Host
Write-Host '***************************************************************************'
Invoke-Command -ComputerName $global:ComputerName -scriptBlock {query session} -credential $global:adminCreds
}

Function logUserOff {
Write-Host
$SessionNum = Read-Host 'Session ID number to log off?'
$title = "Log Off"
$message = "Are you sure you want to log them off?"
$yes = New-Object System.Management.Automation.Host.ChoiceDescription "&Yes", `
"Logs selected user off."
$no = New-Object System.Management.Automation.Host.ChoiceDescription "&No", `
"Exits."
$options = [System.Management.Automation.Host.ChoiceDescription[]]($yes, $no)
$result = $host.ui.PromptForChoice($title, $message, $options, 1)

switch ($result){
0 {
Write-Host
Write-Host 'OK. Logging them off...'
Invoke-Command -ComputerName $global:ComputerName -scriptBlock {logoff $args[0]} -ArgumentList $SessionNum -credential $global:adminCreds
Write-Host
Write-Host 'Success!' -ForegroundColor green
break
}
1 {break}
}
}

Do {
getSessions
logUserOff

Write-Host
#Write-Host "Press any key to continue ..."
# $x = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")

#Configure yes choice
$yes = New-Object System.Management.Automation.Host.ChoiceDescription "&Yes","Remove another profile."

#Configure no choice
$no = New-Object System.Management.Automation.Host.ChoiceDescription "&No","Quit profile removal"

#Determine Values for Choice
$choice = [System.Management.Automation.Host.ChoiceDescription[]] @($yes,$no)

#Determine Default Selection
[int]$default = 0

#Present choice option to user
$userchoice = $host.ui.PromptforChoice("","Logoff Another Profile?",$choice,$default)
}
#If user selects No, then quit the script
Until ($userchoice -eq 1)

I love this script.. but what could I add as an option to say log off “all users”?

we have a process that allows 50 people to connect, and I don’t want to list each session ID one at a time..

An option to remove all users by typing “All” instead of a number would make this flawless!

thanks so much..

I wrote this:  It will scan all servers you select for users that are logged on and lets you select users to log off.

Function YesNo
{
Param($provide)
$a = new-object -comobject wscript.shell
$popup = “Do you want to Select the servers to scan ?”
$intAnswer = $a.popup($popup, `
0,$provide,4)
If ($intAnswer -eq 6) {
$answer = “yes”
} else {
$answer = $null
}
return $Answer
}
Function DisplayInfo
{
Param($Servers)
cls
write-host
$count = $servers.count
write-host $count -ForegroundColor Yellow -NoNewline
write-host ” servers selected to investigate.” -ForegroundColor Green
write-host “The total of servers in the AD is :” -ForegroundColor Green -NoNewline
Write-Host (get-adcomputer -filter {Operatingsystem -like “Windows Server*”} | select name).count -ForegroundColor Red
Write-Host
}
Function Selection
{
#$servers = (get-adcomputer -filter {Operatingsystem -like “Windows Server*”} | sort name | select name).name
$servers = (get-adcomputer -LDAPFilter “(&(objectCategory=computer)(operatingSystem=Windows Server*)(!serviceprincipalname=*MSClusterVirtualServer*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))” -Property name | sort-object Name).name
if (yesNo -eq “Yes”)
{
$servers = $servers | out-gridview -passthru
}
return $servers
}

Function DoIt
{
Param($Servers)
$completelist = @()
foreach ($server in $servers)
{
$serverdisp = $server.PadRight(($servers | Measure-Object -Maximum -Property Length).Maximum)
$Skip = 0
Write-host “Checking server ” -ForegroundColor Green -NoNewline; write-host $Server -ForegroundColor Yellow -NoNewline
if (Test-Connection $server -count 1 -Quiet)
{
Write-Host ” —— (online)” -ForegroundColor Green
$sessionId = $null
try
{
#$ErrorActionPreference = “SilentlyContinue”
$SessionIds = quser /server:$server 2>&1
#$ErrorActionPreference = “Continue”
}
catch
{
Write-Host ” – ” -ForegroundColor Green -NoNewline
write-host “$serverdisp seems inaccessible.” -ForegroundColor Red -NoNewline
Write-Host ” No data available.” -ForegroundColor Yellow
write-host ” ———————- ” -ForegroundColor green
$skip = 1
}
if ($Skip -eq 0)
{
$nr = $sessionIds.count-2
$c=0
do
{
$c++
$user = (($sessionIds[$c]) -split ‘ +’)[1]
$session = (($sessionIds[$c]) -split ‘ +’)[2]
$State = (($sessionIds[$c]) -split ‘ +’)[3]
$IdleT = (($sessionIds[$c]) -split ‘ +’)[4]
$LogonT = (($sessionIds[$c]) -split ‘ +’)[5] + ” ” + (($sessionIds[$c]) -split ‘ +’)[6]
Write-Host ” – ” -ForegroundColor Green -NoNewline
write-host $serverdisp -ForegroundColor Yellow -NoNewline
Write-Host ” – ” -ForegroundColor Green -NoNewline
write-host $user -ForegroundColor Magenta -NoNewline
Write-Host ” – ” -ForegroundColor Green -NoNewline
write-host $session -ForegroundColor Cyan -NoNewline
Write-Host ” – ” -ForegroundColor Green -NoNewline
write-host $State -ForegroundColor Cyan -NoNewline
Write-Host ” – ” -ForegroundColor Green -NoNewline
write-host $LogonT -ForegroundColor Cyan -NoNewline
Write-Host ” => ” -ForegroundColor Green -NoNewline
write-host $IdleT -ForegroundColor Cyan
# $Ser+=@($server); $use+=@($user);$Ses+=@($session);$sta+=@($state);$Idl+=@($IdleT);$Log+=@($LogonT)
$completelist += @{server=$server;user=$user;session=$session;State=$state;IdleTime=$idleT;LogonTime=$logonT}
}
while ($c -le $nr)
write-host ” ———————- ” -ForegroundColor green
}
}
else
{
Write-Host ” —— (offline)” -ForegroundColor Red
Write-Host ” – No data available.” -ForegroundColor Yellow
write-host ” ———————- ” -ForegroundColor green
}
}
<# $completeList = New-Object PSObject
$completeList | Add-Member NoteProperty Server $Ser
$completeList | Add-Member NoteProperty User $use
$completeList | Add-Member NoteProperty Session $ses
$completeList | Add-Member NoteProperty State $sta
$completeList | Add-Member NoteProperty IdleTime $Idl
$completeList | Add-Member NoteProperty Logon $Log
$completelist = @(server=$ser;user=$use;session=$ses;State=$sta;IdleTime=$idl;LogonTime=$log) #>
return $completeList
}
Function YesNo2
{
Param($Completelist)
$List = $completelist |% {New-Object psobject -Property $_}
$Users = ($completelist |% {New-Object psobject -Property $_}).user | sort -Unique
$a = new-object -comobject wscript.shell
$intAnswer = $a.popup(“Do you want to Log Off (A) certain User(s)?”, `
0,”Logoff Users”,4)
If ($intAnswer -eq 6)
{
$answer2 = $Users | Out-GridView -PassThru
$step = 0
do
{
$logs = $list | where {$_.user -eq $answer2}
foreach ($log in $logs)
{
write-host $log.user -ForegroundColor green -NoNewline
write-host ” logged on to device ” -ForegroundColor Yellow -NoNewline
write-host $log.server -ForegroundColor Green -NoNewline
Write-Host ” since ” -ForegroundColor Yellow -NoNewline
write-host $log.Logontime -ForegroundColor Cyan
write-host “Attempt log off:” -ForegroundColor Yellow -NoNewline
$connect = $log.server
try{Invoke-RDUserLogoff -HostServer $connect -UnifiedSessionId $Log.session -Force ;$logof=”OK”}
catch{$logof=”NOK”}
if($Logof -eq “OK”){ write-host ” was logged off!” -ForegroundColor Green}
else { write-host ” wasn’t logged off!” -ForegroundColor red; write-host “Please check manually.” -ForegroundColor red}

}
$step++
}
while ($step -lt $answer2.count)
}
}

# SO now let’s play!
$Servers = Selection
Displayinfo $servers
$completelist = DoIt $servers
yesno2 $completelist

Koen, thank you! This script is really … really very useful!

Danny,

if you really want all AD-devices, then alter line 30 to:

$servers = (get-adcomputer -Filter * -Property name | sort-object Name).name

grts

Koen

$scriptBlock = {
     $ErrorActionPreference = 'Stop'
 
     try {
         ## Find all sessions matching the specified username
         $sessions = quser | Where-Object {$_ -match 'teste'}
         ## Parse the session IDs from the output
         $sessionIds = ($sessions -split ' +')[3]
         Write-Host "Found $(@($sessionIds).Count) user login(s) on computer."
         ## Loop through each session ID and pass each to the logoff command
         $sessionIds | ForEach-Object {
             Write-Host "Logging off session id [$($_)]..."
             logoff $_
         }
     } catch {
         if ($_.Exception.Message -match 'No user exists') {
             Write-Host "The user is not logged in."
         } else {
             throw $_.Exception.Message
         }
     }
 }

This piece of code is exactly what I need, it just won’t work if the user is not connected, the catch part isn’t working.

@ Koen  It really very useful script,Thank you very much for it

I tried to use it for all AD computers but it shows "[5]:Access – is – denied." when Checking server,However it is working fine with servers 

my user is domain admins,it there any thing to do from my side to fix this issue.Last thank you again for this fantastic script

The post below seems to be a replication of this work, Adam. It doesn't appear to give you credit for it. I am uncertain if this is authorized or not, but thought I would mention it.

https://www.heelpbook.net/2018/force-a-user-logoff-remotely-with-powershell/