FortiSOAR Discussions
Ali_Maher
New Contributor III

Action: Logout RDP Session when exceeds the allowed numbers

Hi All,

I hope all is well.

 

We are the progress of creating a use case to check the number of the concurrent RDP session for specific account.

 

Business needs: -

 

1- we have a shared account which is allowed to concurrently login RDP through three servers.

2- we need to disconnect all the RDP sessions once reached to four sessions as that means the credential is compromised.

 

SOAR Automation: -

1- we could recognize the number of the concurrent sessions and we are able to integrate with the active directory.

2- take the " Reset Password " Action to default one preconfigured.

 

But the concurrent sessions of the RDP still connected, and we need to enforce logout them. 

 

FortiSOAR 

#ActiveDirectory

 

@Community 

BR, Ali Maher
BR, Ali Maher
1 REPLY 1
anarula
Staff
Staff

Interesting Ask @Ali_Maher .

 

I tried to look into PowerShell options and came across this:

https://github.com/Techsupport4me/David-Powershell/blob/master/Modules/RDS-Manager/RDS-Manager.psm1

 

Disclaimer: I haven't tried it yet, so can't be sure

CTO (SOAR Business) | VP of Engineering