Logoff user session remotely

I found a useful method to use WMI to logoff remotely a user session (on a workstation for example). It has been tested successfully on a Windows 7 computer.

This WMI method can be found with the following command:

gwmi win32_operatingsystem | get-member | ? {$_.MemberType -eq "Method"}

Output

TypeName: System.Management.ManagementObject#root\cimv2\Win32_OperatingSystem

Name MemberType Definition
---- ---------- ----------
Reboot Method System.Management.ManagementBaseObject Reboot()
SetDateTime Method System.Management.ManagementBaseObject SetDateTime(System.String LocalDateTime)
Shutdown Method System.Management.ManagementBaseObject Shutdown()
Win32Shutdown Method System.Management.ManagementBaseObject Win32Shutdown(System.Int32 Flags, System.Int32 Reserved)
Win32ShutdownTracker Method System.Management.ManagementBaseObject Win32ShutdownTracker(System.UInt32 Timeout, System.String Comment, System.UInt32 ReasonCode, System.Int32 Flags)

To logoff a user session on a remote computer, we will use the WMI method called Win32Shutdown

$computer="computer01"
(gwmi win32_operatingsystem -computername $computer).Win32Shutdown(4)

The value 4 is used for a forced logoff. The Microsoft article describes the available codes:

Bitmapped set of flags to shut the computer down. To force a command, add the Force flag (4) to the command value. Using Force in conjunction with Shutdown or Reboot on a remote computer immediately shuts down everything (including WMI, COM, and so on), or reboots the remote computer. This results in an indeterminate return value.

0 (0x0) Log Off

4 (0x4) Forced Log Off (0 + 4)

1 (0x1) Shutdown

5 (0x5) Forced Shutdown (1 + 4)

2 (0x2) Reboot

6 (0x6) Forced Reboot (2 + 4)

8 (0x8) Power Off

12 (0xC) Forced Power Off (8 + 4)

My Powershell script categories

Logoff user session remotely

Leave a Reply Cancel reply