Question

我正在尝试编写一个脚本来记录用户启动远程桌面以登录Windows Server的Windows客户端的IP地址。如何在服务器中捕获客户端的IP地址？

Answer 1

所以，你忽略代理......

在域中使用环境var：CLIENTNAME，您可以将其解析回IP

没有域控制器：

使用WMI脚本，您可以访问事件日志，源：安全性，查找类别登录/注销，其中username =环境变量USERNAME

Answer 2

如果您使用的是PowerShell或.NET语言，Cassia library的主干版本支持此功能 - 只需从build server获取最新版本（以访客身份登录并使用工件链接））。要在本地服务器上打印所有会话的远程地址，可以使用以下内容：

ITerminalServicesManager manager = new TerminalServicesManager();
foreach (ITerminalServicesSession session in manager.GetLocalServer().GetSessions())
{
    IPEndPoint ipEndPoint = session.RemoteEndPoint as IPEndPoint;
    if (ipEndPoint != null)
    {
        Console.WriteLine(ipEndPoint.Address);
    }
}

Answer 3

如果你想使用“纯粹的”Powershell 2.0：

$Wtsapi32 = @'
using System;
using System.Text;
using System.Runtime.InteropServices;

namespace Wtsapi32 {

    public enum WTS_INFO_CLASS
    {
        WTSInitialProgram,
        WTSApplicationName,
        WTSWorkingDirectory,
        WTSOEMId,
        WTSSessionId,
        WTSUserName,
        WTSWinStationName,
        WTSDomainName,
        WTSConnectState,
        WTSClientBuildNumber,
        WTSClientName,
        WTSClientDirectory,
        WTSClientProductId,
        WTSClientHardwareId,
        WTSClientAddress,
        WTSClientDisplay,
        WTSClientProtocolType
    };  

    [StructLayout(LayoutKind.Sequential)]
    public struct WTS_CLIENT_ADDRESS
    {
        public uint AddressFamily;
        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 20)]
        public byte[] Address;
    }

    public class PS {

        public const IntPtr WTS_CURRENT_SERVER_HANDLE = IntPtr.Zero;
        public const int WTS_CURRENT_SESSION = -1;

        [DllImport("wtsapi32.dll",  EntryPoint="WTSQuerySessionInformation")]
        public static extern bool WTSQuerySessionInformation(
            System.IntPtr hServer, 
            int sessionId, 
            WTS_INFO_CLASS wtsInfoClass, 
            out System.IntPtr ppBuffer, 
            out uint pBytesReturned);

        [DllImport("wtsapi32.dll",  EntryPoint="WTSFreeMemory")]
        public static extern void WTSFreeMemory(
            IntPtr memory);         
    }
}
'@

Add-Type -TypeDefinition $Wtsapi32

如何获取远程桌面客户端的IP地址？

3 个答案: