How do I determine how long it's been since a user with files opened on my server has been actively using their workstation in a Windows Active Directory environment (XP, 7, 8 clients and Server 2008, 2012)?
Before rebooting the file server I check to see if anyone has open files on the server, so I check the Open Files pane of the Shared Folders MMC:
Because Redirected Folders are in use, a logged in user will have open files, even if it's been a while since they've been at their computer. I notice an Idle Time column on the Sessions pane of the MMC:
As I understand it, this is the idle time for the SMB session between the workstation and the server. Is this able to indicate how long it's been since the user was active? Or could a logged in workstation without user activity reset this counter to 0:00?
I've also explored the output of QWINSTA run via PSEXEC against the user's workstation. This tells me the session's state is Active, but I don't know if that's the same as "logged on" or "active in the past X minutes."
So, is there a way to determine how long it's been since a workstation has had an active user? Perhaps by a method other than these two I've tried?
The idle time shown in your screenshots can indicate user inactivity. If the user were to leave a program that periodically accesses the file server this number wouldn't indicate time where a user is not present providing input to the computer.
One quick-and-dirty idea comes to mind: Use the creation time of a screensaver process
Assuming the user is running a screensaver (or that you're forcing it with Group Policy), remotely scanning the process list for an
.SCRand looking at the difference between the current wallclock time and the process creation time would give you an idea of the length of time the PC hasn't received mouse or keyboard input.