Determine if a Workstation is locked via a script

Posted on 2009-04-16
Last Modified: 2012-05-06
A recent MS security patch has broken my solution. So now I need to find another way. I need to be able to remotely determine if a Windows machine is locked or unlocked when a user is logged in. I use to be able to run a program on a remote machine interactively using, psexec -i, that would check the position of the mouse. If it had a crazy number, the machine was locked. Well apparently a recent patch has broken the -i option in psexec. So I can no longer remotely run programs that will interact with the console session. Atleast that is what it looks like.  Any ideas?  VBscript is prefered since all windows machines have that in our organization.
Question by:Unisys1
    LVL 47

    Accepted Solution

    Here's a script I have used in the past, you will also need lsgrab in the same directory as the script.

    'Script version 2.0
    'Valid command-line argument is:
    'computer:computername|IP Address
    'path:"x:\fullpath"|".\" (current directory
    Set WshShell = WScript.CreateObject("WScript.Shell")
    Set WshSysEnv = WshShell.Environment("PROCESS")
    Set objArgs = WScript.Arguments
    on error resume next
    Dim strComputer, strMsg
    strScriptPath = replace(wscript.scriptfullname,wscript.scriptname,"")
    'Set the screenshot grabber path in relation to the script path
    strLsGrab = chr(34) & strScriptPath & "lsgrab\lsgrab.exe" & chr(34)
    strTempFile = WshSysEnv("TEMP")
    'Get command-line arguments for a passed computername or IP address.
    If objArgs.Count > 0 Then 
    	 For I = 0 to objArgs.Count - 1
       If InStr(1,LCase(objargs(I)),"computer:") Then
       	strComputerArray = split(lcase(objargs(I)),"computer:")
       	strComputer = strComputerArray(1)
       ElseIf InStr(1,LCase(objargs(I)),"path:") Then
       	strPathArray = split(lcase(objargs(I)),"path:")
       	strPath = strComputerArray(1)
       End If
    ElseIf objargs.count = 0 then
    	strComputer = inputbox("Enter the name of the computer you wish to enable and retreive a screen capture " _
    	 & "from","Enter a computername")
    	If strComputer = "" Then wscript.quit
    End If
    if strPath = "" then strPath = ".\"
    'If the passed computername contains any backslashes, remove them.
    If InStr(strComputer,"\") Then strComputer = replace(strComputer,"\","")
    dim bFatal
    'Check to see if a user is logged in remotely.
    Const wbemFlagReturnImmediately = &h10
    Const wbemFlagForwardOnly = &h20
       Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
       Set colItems = objWMIService.ExecQuery("SELECT UserName FROM Win32_ComputerSystem", "WQL", wbemFlagReturnImmediately + wbemFlagForwardOnly)
       For Each objItem In colItems
          strUser = objItem.UserName
       if err.number <> 0 then 
        strUser = ""
        'msgbox err.number & " " & err.description
    		bFatal = true
    	 if err.number = 451 then strMsg = "Could not enumerate WMI class.  You may not have permissions on the remote computer."
       end if
    If bFatal <> true then 
      Call Screenshot(strComputer)
      Msgbox "Cannot acquire remote screenshot." & vbcrlf & vbcrlf & strMsg,48,"Screenshot unavailable."
    End If
    Function Screenshot(strComputer)
    	Set WshShell = WScript.CreateObject("WScript.Shell")
      'Finally, run the screen grabber command
      strCommand = strLsGrab & " /c:" & strComputer & " /p:" & chr(34) & WshSysEnv("TEMP") & "\" & chr(34)
      'strInput = inputbox("the path is: ","test",strCommand)
      Set oExec = WshShell.Exec(strCommand)
      'msgbox oExec.stdout.readall
      if instr(oExec.stdout.readall,"denied") then
        msgbox "You do not have sufficient permissions on '" & strComputer & "' to retrieve the remote screen capture."
        Set objFSO = WScript.CreateObject("Scripting.FileSystemObject")
        strFile = WshSysEnv("TEMP") & "\" & strComputer & ".jpg" 
        'msgbox strFile
        Set f = objfso.GetFile(strFile)
        set objfso = nothing
        if f.size < 20000 Then 'less than 20kb
           msgbox "Remote workstation was locked, so no screenshot was available.",48,"No screenshot created"
      	'msgbox "Now attempting to open " & chr(34) & WshSysEnv("TEMP") & "\" & strComputer & ".jpg" & chr(34)
      	   on error resume next
 chr(34) & WshSysEnv("TEMP") & "\" & strComputer & ".jpg" & chr(34),1,false
        End If
      End if
    End Function

    Open in new window

    LVL 66

    Expert Comment

    Still use PSEXEC, but instead of running a script, just run tasklist, without the Interactive switch.

    If you see logon.scr, should be locked.....

    Or even this. Copy it to a batch file named locked.bat, in the same directory as psexec

    psexec \\RemotePC -c c:\Path\To\locked.bat

    @echo off
    tasklist | find /i "logon.scr"
    if %errorlevel%==0 goto lock
    echo PC is unlocked.

    echo PC is locked


    Author Comment

    Very nice simple script, this is only working if the screen saver is running.  Although will help in a pinch.  If they just locked their machine it doesn't help.  
    LVL 47

    Expert Comment

    Did you try the option i gave above? it works for me, as I use it in conjunction with a remote assistance script
    LVL 66

    Expert Comment

    Yea, assumed that it wouldnt have been a manual lock......

    Let me investigate in the am....

    Author Comment

    dstewartjr, so I have to use this in conjunction with other software?
    LVL 47

    Expert Comment

    You would download lsgrab from the link I provided, you then place it and the script in same folder and run the script from there.

    I came across this from here:


    Download and give this app a look

    Featured Post

    Find Ransomware Secrets With All-Source Analysis

    Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

    Join & Write a Comment

    When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
    This is an article about Leadership and accepting and adapting to new challenges. It focuses mostly on upgrading to Windows 10.
    As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
    The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…

    731 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now