Action: Logout RDP Session when exceeds the allowed numbers

Hi All,

I hope all is well.

We are the progress of creating a use case to check the number of the concurrent RDP session for specific account.

Business needs: -

1- we have a shared account which is allowed to concurrently login RDP through three servers.

2- we need to disconnect all the RDP sessions once reached to four sessions as that means the credential is compromised.

SOAR Automation: -

1- we could recognize the number of the concurrent sessions and we are able to integrate with the active directory.

2- take the " Reset Password " Action to default one preconfigured.

But the concurrent sessions of the RDP still connected, and we need to enforce logout them.

#ActiveDirectory

@Anonymous

Staff

Interesting Ask @Ali_Maher .

I tried to look into PowerShell options and came across this:

Disclaimer: I haven't tried it yet, so can't be sure

Sign up