Get Client ComputerName for Process on Terminal Server - windows

Question

I'm running a script to gather info for running apps on a terminal server. I would like to get the remote ComputerName of the user running the app but I'm only able to get the ComputerName of the Terminal Server instead. Any idea on how I could achieve that? Here's the part of my script to gather the info.
Get-WmiObject Win32_Process -ComputerName MYTSSERVER | Where-Object {
$_.mainwindowhandle -ne 0 -and
$_.Name -eq "WINWORD.exe"
} | Select-Object CSName, ProcessName

Answer 1

You can't get the client hostname or IP address from the Word process, because that process is running locally on the Remote Desktop server. Remote Desktop login information is recorded in the eventlog, so you need to extract it from there. However, you need the remote username for finding the correct logon session, so you still need to run the WMI query first.
Example for a single Word process running on the Remote Desktop server:
$server = '...'
$p = Get-WmiObject Win32_Process -Computer $server -Filter "Name='WINWORD.exe'"
$u = $p.GetOwner().User
$fltr = "*logon type:`t`t`t10*new logon:*account name:`t`t$u"
$addr = Get-EventLog -Computer $server -LogName Security -InstanceId 4624 -Message $fltr -Newest 1 |
Where-Object { $_.Message -match 'source network address:\s*(.*)' } |
ForEach-Object { $matches[1] }
The filter for the eventlog query matches the most recent Remote Desktop login (event ID 4626, logon type 10) of the user who started the Word process (account name:`t`t$u).
That will just give you the client's IP address, though. If you require the hostname you need to resolve it via a reverse DNS lookup or get it from the host itself with another WMI query:
$hostname = Get-WmiObject Win32_OperatingSystem -Computer $addr |
Select-Object -Expand CSName