Writing Terminal Service Based Scripts (Part 1)

If you would like to read the next articles in this series please go to:

Being a child of the 1980s, I pretty much grew up with DOS. As such, I became very comfortable with DOS commands, and still work extensively with the Windows Command Prompt to this day. Many administrators simply assume that the Windows Command Prompt is a relic that’s left over from the 1980s. In fact, I’ve got a good friend in Kentucky who has been making fun of me for well over a decade for my various Command Prompt exploits (yes, I’m talking to you Shamir).

There is a lot more to the Command Prompt than meets the eye. As Windows has evolved, so too has the Command Prompt. Sure, most of the original DOS commands are still supported, but Microsoft has added countless new commands over the years. Many of these commands are networking related, and some are specifically related to the Windows Terminal Services.

In this article series, I am going to introduce you to some of the commands that are the most useful to terminal service administrators. Some of the commands that I will be discussing are not directly related to the terminal services, but are still very useful in a terminal service environment. Other commands are specifically related to the terminal services. My plan is to spend the next several articles in this series introducing you to some various commands, and demonstrating how those commands work. Later in the series, I will show you how to use the various commands to create automated scripts.

The Change Logon Command

The Change Logon command allows you to enable or disable session logins from the Command Prompt or from an automated script. One way that I have seen this command used in the real world involved a company which needed to lock the users out of a particular server for a few hours each night so that various maintenance tasks could be performed. The administrator of that particular company developed a script that disabled session logons, ran the maintenance tasks, and then re-enabled logons.

The syntax for this command is very simple. Simply enter the CHANGE LOGON command, followed by one of three switches:

  • /QUERY  Tells you whether session logons are currently enabled or disabled
  • /ENABLE  Enables session logons
  • /DISABLE  Disables session logons

If you look at Figure A, you can see the Change Logon command in action. In the figure, I have entered the CHANGE LOGON /? command so that you can see the command syntax, and then I have entered the CHANGE LOGON /QUERY command, so that you can see the query’s output.

Figure A: The CHANGE LOGON command allows you to enable or disable session logins

Some environments do not support the use of commands that are made up of more than one word (IE: Change Logon). As such, Microsoft has created a single word version of this command. The single word command is: CHLOGON. The syntax works exactly the same whether you use the CHLOGON or Change Logon.

The Change Port Command

The Change Port command is quickly becoming obsolete, but since there are some organizations that could still benefit from using this command, I wanted to go ahead and show it to you.

The idea behind the Change Port application is that some legacy applications (particularly DOS based applications) are hard coded to use specific serial ports. This can be a real problem if a particular port is already in use, or if it simply does not exist. For example, what happens if an application is coded to use COM2, but the machine only has one serial port?

The Change Port command can be used to remap serial ports. For example, if an application is hard coded to use COM2, but the machine only has a single serial port, the port mapping can be changed so that calls to COM2 are redirected to COM1.

There are three different things that you can do with the Change Port command. Your first option is to remap a serial port. You can do so by using the portx=porty parameter. For example, if you wanted to redirect calls from COM2 to COM1, you would use the following command:

CHANGE PORT port2=port1

Another thing that the Change Port command allows you to do is to delete a port mapping. To do so, simply follow the Change Port command with the /D switch and the port number. For example, if you wanted to delete the mapping for Port 2, you would enter the following command:

Change Port /D port2

The Change Port command also supports the use of the /Query switch. This allows you to view the current port mappings. The interesting thing about the /Query switch is that it reveals some inconsistencies between Windows versions. In my lab environment, when I ran the Change Port /Query command on a machine that was running Windows Server 2003, and that did not contain any physical serial ports, I received a message indicating that no port mappings exist. When I tried the same thing on a machine that was running Windows Vista, the command revealed the mappings shown in Figure B.

Figure B: The Change Port /Query command reveals the machine’s serial port mappings

Like the Change Logon command, there is also an abbreviated version of the Change Port command. The abbreviated version of this command is CHGPORT.

The Query Session Command

One of the most simple terminal service related commands is also one of the most useful. The Query Session command can be entered without any additional parameters. Upon doing so, Windows will provide you with information about all of the sessions that are currently attached to the server. As you can see in Figure C, Windows tells you the session name, the name of the user who is logged in through the session, the session ID number, whether or not the session is active, and the type of session.

Figure C: The Query Session command provides information about current terminal service sessions

Just because the Query Session command doesn’t require you to use any parameters, it doesn’t mean that you can’t use optional parameters. You can easily filter the output by entering a particular username, session name, or session ID after the command. For example, if you wanted to know about session number 65536, you would enter the following command:

Query Session 65536

There are a few command line switches that you can use as well. Here is a brief description of the available switches:

  • /SERVER:servername  Allows you to specify the name of the server that you want to query
  • /MODE  Lists the baud rate, parity, number of data bits, and stop bits for each session.
  • /FLOW  Tells you whether or not a session is using flow control.
  • /CONNECT  Lists each session’s connection method
  • /COUNTER  Provides a summary of the number of sessions that were created, disconnected, and reconnected.


In this article, I began discussing some various commands that can be used in a terminal service environment. In Part 2, I will continue the discussion by showing you some more commands that you can use. Later on in the series, I will eventually show you how to combine some of the various commands to create some useful automated scripts.

If you would like to read the next articles in this series please go to:

Leave a Comment

Your email address will not be published.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top