Action: Logout RDP Session when exceeds the allowed numbers

[Ali_Maher]

Hi All,

I hope all is well.

We are the progress of creating a use case to check the number of the concurrent RDP session for specific account.

Business needs: -

1- we have a shared account which is allowed to concurrently login RDP through three servers.

2- we need to disconnect all the RDP sessions once reached to four sessions as that means the credential is compromised.

SOAR Automation: -

1- we could recognize the number of the concurrent sessions and we are able to integrate with the active directory.

2- take the " Reset Password " Action to default one preconfigured.

But the concurrent sessions of the RDP still connected, and we need to enforce logout them. 

FortiSOAR  

#ActiveDirectory

@Community 

[anarula]

Interesting Ask @Ali_Maher .

I tried to look into PowerShell options and came across this:

https://github.com/Techsupport4me/David-Powershell/blob/master/Modules/RDS-Manager/RDS-Manager.psm1

Disclaimer: I haven't tried it yet, so can't be sure