Find Active Terminal Server Session IDs in Regedit

This article outlines how to locate active user session identifiers on a Windows Terminal Server using the Windows Registry Editor (Regedit). Because Remote Desktop Services (RDS) handles active sessions dynamically, session-specific runtime information and identifiers are mapped directly to loaded user profiles within the registry hive rather than in a single static list.

Primary Registry Location for Active Sessions

Active user sessions are dynamically stored under the HKEY_USERS hive. When a user logs in to a Terminal Server, their user profile and session metadata are mounted in this location.

To view the active session identifiers:

Open the Registry Editor by pressing Win + R, typing regedit, and pressing Enter.
Navigate to:
```
HKEY_USERS
```
Look for the individual Security Identifier (SID) subkeys (e.g., S-1-5-21-...). Loaded SIDs that do not end in _Classes represent currently logged-in or disconnected active sessions.
Expand the target user SID and navigate to:
```
HKEY_USERS\<User-SID>\Volatile Environment
```
If a user has multiple or numbered sessions, subkeys matching the numeric Session ID (such as 1, 2, etc.) will appear directly under Volatile Environment.

Key Session Values

Inside the Volatile Environment key (or its numbered Session ID subkeys), the following values provide specific session details:

SESSIONNAME: Displays the active session type and identifier (e.g., Console for local access, or RDP-Tcp#0 for an active Remote Desktop session).
CLIENTNAME: The hostname of the remote machine connected to the session.
USERNAME: The username associated with that specific session.
USERDOMAIN: The domain name of the logged-in user.

Terminal Server System Configuration Keys

For global Remote Desktop session configurations, connection limits, and listener settings, refer to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server

Active runtime session states are managed dynamically in system memory by the Session Manager subsystem (smss.exe) and the Remote Desktop Service, while individual session parameters remain accessible under each active user’s Volatile Environment key.