This script will list disconnected RDS sessions and their processes on a Windows server.


@echo off

rem get the disconnected usernames and pass the values to tasklist (%%i)
for /f "tokens=1" %%i in ('query session ^| find ^"Disc^" ^| find /V ^"services^"') do ( 
    echo Username: %%i
    echo ==============================================================================
    rem list username's processes that are greater than "200 000 K"
    tasklist /FI "USERNAME eq %%i" | findstr /r "[2-9][0-9][0-9].[0-9][0-9][0-9].K"