zabbix_export:
  version: '6.0'
  date: '2021-11-21T21:22:26Z'
  groups:
    -
      uuid: 7df96b18c230490a9a0a9e2307226338
      name: Templates
  templates:
    -
      uuid: 4458f02a6c654346af0c2b2fe9377447
      template: RDPUsers
      name: RDPUsers
      description: |
        ## Overview
        
        RDP Logged on Users
        
        
        I use this template to check Users, that are logged on RDP sessions on Windows servers. It's not full audit, it's only for current view of logged-on users.
        
        
        Template is really simple.It has only one Item and user parameter configured on monitored server.
        
        
        User parameter in zabbix\_agentd.conf: UserParameter=RDPUsers,"c:\zabbix\RDPUsers.cmd" Script RDPUsers.cmd:
        
        
        @echo off
        
        
        for /F "usebackq tokens=1,2,3,4,5*" %%i in (`qwinsta ^| find "Active"`) do (
        
        
         if "%%l" == "Active" ( echo %%j )
        
        
        )
        
        
        I was asked to enhance script for monitoring disconnected terminal users too. So this is my second version of script. Script adds "D:" before name for disconnecter users and "A: "for Active users. Script was tested only for English version of Windows server:
        
        
        New script RDPUsers.cmd:
        
        
        @echo off
        
        
        for /F "usebackq tokens=1,2,3,4,5*" %%i in (`query user 2^>nul`) do (
        
        
         if "%%l" == "Active" ( echo A: %%i )
        
        
         if "%%k" == "Disc" ( echo D: %%i )
        
        
        )
        
        
        
        
      groups:
        -
          name: Templates
      items:
        -
          uuid: 8c34a0ed92bf4547b86d7d120d69fa3a
          name: 'Logged Users'
          type: ZABBIX_ACTIVE
          key: RDPUsers
          delay: '120'
          history: 2d
          trends: '0'
          value_type: TEXT
          description: 'http://serverfault.com/questions/511120/getting-just-the-active-remote-desktop-sessions'
          tags:
            -
              tag: Application
              value: Audit