Session Watch (Preview) monitors a remote PowerShell session to Active Directory and records when the session, server-side session, network connection, or domain controller checks change state. You can use the resulting CSV and summary files to compare UTC timestamps with other logs.
Preview status and supported scope
Session Watch is a preview feature. It can change or be removed before its full release, and it might not become generally available. This preview monitors Active Directory sessions over IPv4 only. It does not monitor Exchange sessions.
What Session Watch records
Session Watch opens one remote PowerShell session to the Active Directory server from the container where the tool runs. It uses the same connection method as the production container and keeps the session open for the duration you select.
During each cycle, Session Watch checks the open session, the other sessions on the Active Directory server that use the same account, and network connectivity. It writes each result to a CSV file and writes a summary when the test ends.
Use Session Watch to:
- Identify whether and when the session stops working.
- Record temporary failures, including a failed check that succeeds in the next cycle.
- Determine whether a problem first appeared in the session, Active Directory server, network, or a domain controller.
- Collect UTC timestamps for comparison with other logs.
Session Watch collects observations. It does not identify the cause of a problem.
This preview covers Active Directory only, over IPv4. It does not watch Exchange sessions.
Review account usage and logging before starting
The test uses the account that you enter. This is normally the account used by the production container during on-premises configuration.
- Account session limits: test sessions count toward the same per-user limits on the Active Directory server. A long-running test adds load to that account.
- Domain controller logs: each cycle makes at least three calls with the account. These calls generate logon events, including 4624 and 4634, plus Kerberos or NTLM events, in the security log on domain controllers. Notify Active Directory administrators before running a long test.
- Authentication method: Windows selects Kerberos when Url AD contains a server name and the container can reach a domain controller. Windows selects NTLM in other cases, such as when Url AD contains an IP address. If NTLM is disabled, only Kerberos can be used. In that configuration, an IP address in Url AD usually fails.
- Window: keep the tool open for the full test duration. Use a full-screen window for a better user experience.
Start a Session Watch test
- In the menu, under “Preview”, select “Session Watch (Preview)”.
- Enter the Active Directory account, password, and Url AD. Use the name of the Active Directory server as configured for the production container.
- Answer the three configuration questions. Press Enter to accept a default value.
| Question | Default | Meaning |
|---|---|---|
| Duration in minutes | 30 | The total test duration. Select a value longer than the period after which the problem usually occurs. |
| Interval in seconds | 90 (minimum 30) | The pause between cycles. A shorter interval records more detail and creates more logon events. |
| Command timeout in seconds | 60 | The maximum time a check can wait for a response before Session Watch records it as HANG. This timeout also applies when opening and closing a session. |
- Review the warning, which shows the expected number of cycles and calls, and then confirm the test.
Checks performed during each test
The screen shows one line for each check and displays recent events below the table.
| Check | What it does |
|---|---|
| AD read | Reads each domain through the session that Session Watch keeps open. |
| Account shells | Checks the other remote sessions that use the same account on the Active Directory server. |
| Watch shell | Checks the Session Watch session as the Active Directory server sees it. |
| Network AD | Performs name lookup and a connection attempt from the container to each Active Directory server address on port 5985. |
| DC snapshot | At the start, end, and first KO or HANG for AD read, opens a short separate session on the Active Directory server. The session checks every domain controller on ports 88 and 9389, then performs one read when port 9389 is open. Port 88 is used for Kerberos. Port 9389 is used for Active Directory Web Services, which the Active Directory PowerShell commands use. |
| Fresh session | At the first KO or HANG for AD read, opens a new session to the same server with the same account. This shows whether a new session can open while the original session cannot be used. |
Interpret the on-screen columns
- Status: The most recent result.
- Last ms and Min/Avg/Max ms: Response times.
- OK/Bad: The number of successful and unsuccessful checks. Bad includes KO, HANG, and BUSY.
- Detail: A result or error message shortened to fit the window. The full text is written to the CSV file. The value is yellow when the status changed in the current cycle.
Stop a test before its scheduled end
Press Q or Ctrl+C to stop the test. Session Watch closes its sessions and writes the summary. If cycles have already started, it performs one final domain controller check before closing.
Each session-close operation waits no longer than the configured command timeout.
Status values written by Session Watch
| Status | Meaning |
|---|---|
| OK | The check completed successfully. |
| KO | The check failed with an error. |
| HANG | The check did not return a response before the timeout. |
| BUSY | The check did not run because the session was still busy with a command recorded as HANG. |
| STOPPED | The test was interrupted with Q or Ctrl+C. |
Find the CSV and summary files
Session Watch writes all files to C:\temp. Each file name contains the local start date and time.
| File | Content |
|---|---|
sessionwatch_<date>_<time>.csv |
All test results, written while the test runs. |
sessionwatch_<date>_<time>_rest.csv |
Created only when the main CSV is locked at the end of the test, such as when the file is open in Excel. It contains rows that could not be written to the main CSV. |
sessionwatch_<date>_<time>_summary.txt |
The test summary, written when the test ends. |
If the CSV is open in Excel while the test runs, new rows wait until the file is available and are then written to the CSV.
CSV columns
| Column | Content |
|---|---|
| TimeUtc | Date and time in UTC. |
| Cycle | Cycle number. Cycle 0 is the start of the test. |
| Check, Target | The item checked and the domain, machine, or session checked. |
| Status, Ms | The result and response time. |
| SessionState | The state of the session kept open for AD read, such as Opened or Broken. |
| Server | The system that responded. For Network AD, this is the address attempted. |
| Detail | The complete result or error text. |
Create a summary from an existing CSV
To create a summary again, including for an older CSV file, select “Session Watch summary (Preview)” under “Preview” in the menu, and then select the CSV file.
Read the summary file
The summary file contains five sections.
- Header: the source CSV file, UTC start and end time, number of cycles, and test settings.
- ABOUT THE TEST: a four-line description of the test.
- SUMMARY BY CHECK: one row for each check and target. The row contains the counts of OK, KO, HANG, and Other results, the slowest response time, and the first problem time and cycle. Network AD has one row for each address.
-
TIMELINE (UTC): changes only, including start steps; the first problem for each check; each status change; changes to the session state, responding domain controller, and count of other sessions; each domain controller snapshot; and session close events. A line in the format
--- <date> ---identifies each new day. - ABOUT THE CHECKS: a description of each check.
Summary by check example
| Check | Target | OK | KO | HNAG | Other | Slowest | First problem |
|---|---|---|---|---|---|---|---|
| AD read | contoso.local |
3 | 3 | 0 | 0 | 147 ms | 09:48:44 cycle 4 |
| Account shells | dc01.contoso.local |
6 | 0 | 0 | 0 | 39 ms | - |
| Watch shell | dc01.contoso.local |
3 | 3 | 0 | 0 | 39 ms | 09:48:47 cycle 4 |
| Network AD |
192.0.2.10 |
7 | 0 | 0 | 0 | 11 ms | - |
| Network AD |
198.51.100.20 |
0 | 6 | 0 | 0 | 2121 ms | 09:47:09 cycle 1 |
| Fresh session | dg-endurance-AD-check |
1 | 0 | 0 | 0 | 161 ms | - |
| DC snapshot | dc01.contoso.local |
2 | 0 | 0 | 0 | 98 ms | - |
Timeline (UTC)
--- 2026-10-24 --- | ||
| 09:47:09 | Network AD |
198.51.100.20 KO: Filtered - no answer within 2000 ms |
| 09:48:44 | AD read | session Opened → Broken
|
| 09:48:44 | AD read |
contoso.local OK → KO: Cannot perform the operation because the runspace pool is not in the Opened state. The current state is Broken. |
| 09:48:46 | Fresh session | OK: opened |
| 09:48:47 | DC snapshot |
dc01.contoso.local OK: first failure: 88 Open - 9389 Open - read OK |
| 09:48:47 | Close session |
dg-endurance-AD-check OK in 12 ms |
| 09:48:47 | Watch shell | OK → KO: not found on the server - the container sees the session as Broken
|
Interpret summary results
During the test, the Active Directory (AD) endpoint 198.51.100.20 was unreachable on port 5985. All six connection attempts timed out after approximately two seconds. The other AD endpoint, 192.0.2.10, was reachable in all six attempts.
During cycle 4, at 09:48:44 UTC, the persistent AD session changed from Opened to Broken. The AD read check then failed because it could no longer use the existing runspace pool.
The recovery checks succeeded: a new session opened at 09:48:46 UTC, and the domain controller snapshot completed at 09:48:47 UTC. However, the watch-shell check could no longer find the monitored session on the server, confirming that the original persistent session had been lost.
Preview limitations
- Session Watch keeps one session open. The production container can open several sessions at the same time. A problem that requires multiple simultaneous sessions, such as a per-user server limit, might not occur during the test. Account shells shows the number of sessions for the account.
- Session Watch does not inspect the production container. It opens its own session from the container where the tool runs. A problem caused only by the production container, such as its code or load, might not occur during the test.
- Account shells lists sessions for the account only on the server where the Session Watch session connects. If Url AD can lead to more than one server, sessions on other servers are not counted. Session Watch displays a yellow line at the start of the test when this condition applies.