## convert quser.exe output to objects. deals with empty sessionname for disconnected sessions and > prefixing username for current session plus time formats that use AM/PM 
## can also remote with /server:

##  USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
## admingle                                  2  Disc         1:22  18/07/2024 10:57
##>billybob              rdp-tcp#1           4  Active          .  18/07/2024 15:33

(quser.exe /server:cuxenvda19-03) -replace '\bLOGON TIME\b' , 'LOGONDATE LOGONTIME' -replace '\bIDLE TIME\b' , 'IDLETIME' -replace '\s+' , ' ' -replace '^\s+'  | % { if( $_ -cmatch '^(.+) (\d+):(\d+) ([AP]M)$' ) { [int]$shift = 0;if( $matches[4] -eq 'PM' ) { $shift = 12 } ; "{0} {1}:{2}" -f $matches[1] , (([int]$matches[2] + $shift ) % 24 ), $matches[3] } else { $_ } } | ConvertFrom-Csv -Delimiter ' ' -PipelineVariable line | % { if( $null -eq $line.LOGONTIME ) { $line.LOGONTIME = $line.LOGONDATE ; $line.LOGONDATE = $line.IDLETIME ; $line.IDLETIME = $line.STATE ; $line.STATE = $line.ID ; $line.ID = $line.SESSIONNAME ; $line.SESSIONNAME = $null } ; if( $thisSession = ($line.USERNAME -match '^>(.*)$' )) { $line.USERNAME = $matches[1] } ; Add-Member -InputObject $line -MemberType NoteProperty -Name THISSESSION -Value $thisSession -PassThru }