Logoff User with WMI and Powershell

8. Juli 2016 · 3 min Lesezeit · von Jan Weis

Kurz & knapp: Einen angemeldeten Benutzer per PowerShell (auch remote) abmelden geht über die Win32Shutdown-Methode von Win32_OperatingSystem. Modern: Invoke-CimMethod -ClassName Win32_OperatingSystem -MethodName Win32Shutdown -Arguments @{ Flags = 0 } (0 = Abmelden). Der Flags-Wert steuert Abmelden, Neustart oder Herunterfahren — die Werte stehen unten.

Mit diesem kurzen Skript melden Sie über WMI/CIM und PowerShell den angemeldeten Benutzer von einem Server oder Computer ab. Praktisch etwa, um eine hängende Sitzung per Fernzugriff zu beenden oder eine Abmeldung skriptgesteuert auszulösen.

Modern (PowerShell 5.1 and 7 — Get-WmiObject was removed in PowerShell 6):

Invoke-CimMethod -ClassName Win32_OperatingSystem -MethodName Win32Shutdown -Arguments @{ Flags = 0 }  # 0 = log off

Legacy (Windows PowerShell 5.1 and older only):

(Get-WmiObject -Class Win32_OperatingSystem).Win32Shutdown(0) # 0 Is a Flag

  Source: Microsoft Learn - Win32Shutdown method of the Win32_OperatingSystem class

Welche Flags kennt Win32Shutdown?

Bitmapped set of flags to shut the computer down. To force a command, add the Force flag (4) to the command value. Using Force in conjunction with Shutdown or Reboot on a remote computer immediately shuts down everything (including WMI, COM, and so on), or reboots the remote computer. This results in an indeterminate return value.

0 (0x0)

Log Off - Logs the user off the computer. Logging off stops all processes associated with the security context of the process that called the exit function, logs the current user off the system, and displays the logon dialog box.

4 (0x4)

Forced Log Off (0 + 4) - Logs the user off the computer immediately and does not notify applications that the logon session is ending. This can result in a loss of data.

1 (0x1)

Shutdown - Shuts down the computer to a point where it is safe to turn off the power. (All file buffers are flushed to disk, and all running processes are stopped.) Users see the message, It is now safe to turn off your computer. During shutdown the system sends a message to each running application. The applications perform any cleanup while processing the message and return True to indicate that they can be terminated.

5 (0x5)

Forced Shutdown (1 + 4) - Shuts down the computer to a point where it is safe to turn off the power. (All file buffers are flushed to disk, and all running processes are stopped.) Users see the message, It is now safe to turn off your computer. When the forced shutdown approach is used, all services, including WMI, are shut down immediately. Because of this, you will not be able to receive a return value if you are running the script against a remote computer.

2 (0x2)

Reboot - Shuts down and then restarts the computer.

6 (0x6)

Forced Reboot (2 + 4) - Shuts down and then restarts the computer. When the forced reboot approach is used, all services, including WMI, are shut down immediately. Because of this, you will not be able to receive a return value if you are running the script against a remote computer.

8 (0x8)

Power Off - Shuts down the computer and turns off the power (if supported by the computer in question).

12 (0xC)

Forced Power Off (8 + 4) - Shuts down the computer and turns off the power (if supported by the computer in question). When the forced power off approach is used, all services, including WMI, are shut down immediately. Because of this, you will not be able to receive a return value if you are running the script against a remote computer.

Kategorien: SkripteWindows 7Windows 8.1

Tags: PowerShell