In our network, there are several terminal servers based on Windows Server 2012 R2 with Remote Desktop Services (RDS) role, which connects many users from branches and regional offices. It has become necessary to detect, which terminal users sessions generate the bulk of traffic thus loading WAN channels. Most likely these users within the RDP session actively upload or download a large amount of files or send large documents to print through Easy Print.
In our conditions, we cannot completely prevent file transfer between a PC and an RDP server and printing documents over Easy Print, since users need these features to do their work. The only way to solve the problem is to find users who actively transfer data and consult them personally so that they could effectively organize their work to minimize large data transfer during an RDP session.
Microsoft offers two ways to get access to the data of bandwidth usage for each user RDP session: using performance counters or RDS API. I was not able to find a ready solution using RDS API data. The counters were left. Having tried a number of performance counters a managed to find the right ones.
So, open Performance Monitor (perfmon.exe) and add the counter RemoteFX Network/Total Sent Rate(*). It counts the outgoing traffic of a terminal server (B/s).
To make it more demonstrative, select Histogram bar view in the Graph tab if there are a lot of sessions. Specify, say, 100 KB/s (100000) as the value of the vertical scale.
By maximum column values identify the numbers of RDP sessions that are used to send the largest amounts of data.
To compare the number of an RDP session with a user name, you can use qwinsta.exe.
If you need to evaluate traffic during a day/week, you can create a separate group of data collectors counting the incoming/outgoing traffic of user RDP sessions.
In Windows Server 2008 R2, these performance counters are not present, so the approximate values of session traffic can be evaluated using the counters of the group Terminal Services Session: Output Bytes / Input Bytes.
The received data can also be used to obtain average bandwidth per session of one RDS client when calculating the required bandwidth to communication channels to remote branches (sites).