🚰

It knows who drained
the server. Do you?

DrainCtl monitors RDSH drain mode in real time. The moment someone blocks new connections, you know — who did it, when, and how long it's been active.

Download MSI View Source
irm https://lissconsulting.github.io/LISSTech.DrainCtl/install.ps1 | iex
<1s
Detection time
90d
Audit retention
6
Trigger types
N×M
Notification targets
🔒
Kerberos auth
Capabilities
Everything you need to monitor drain mode.
One binary. One service. Real-time visibility across your entire RDSH farm — with a dashboard to prove it.
⚡

Instant Detection

The moment someone runs chglogon /drain, the service knows. No polling delay — Windows notifies DrainCtl directly through the kernel.

👤

Who Changed It

DrainCtl tells you the exact user account that enabled drain mode. Not just that it changed — who did it, and when.

👥

Session Tracking

See active and disconnected sessions on every server. Set a capacity threshold and get alerted before your farm runs out of slots.

🌐

Farm Dashboard

One page for your entire RDSH farm. Live status, session gauges, state history chart, and event log — secured with Kerberos SSO.

🔔

Smart Alerts & Centralized Config

Configure notification targets, grace periods, and alert thresholds once in the dashboard — every agent inherits them. Unlimited webhook and ntfy.sh targets with per-target triggers and repeat intervals.

📋

90-Day Audit Trail

Every state change logged with timestamps, durations, and attribution. Query it from the CLI, PowerShell, or the dashboard.

💻

PowerShell + CLI

12 native cmdlets on PSGallery. Exit codes + JSON for any RMM. Works on PS 5.1 and 7+.

📄

Zero-Touch Discovery

One DNS SRV record and every agent finds the dashboard automatically. Install the MSI, walk away — agents register themselves.

🔒

EV Code-Signed

Every binary, DLL, MSI, and PowerShell script signed with an EV certificate. Trusted from download to execution.

Architecture
Three signals. One answer.
The service triangulates registry notifications, event log subscriptions, and safety-net polling to deliver a definitive, attributed state.

Registry Notification

Windows fires RegNotifyChangeKeyValue the instant TSServerDrainMode is written. Zero delay.

~0ms

Event Log Subscription

EvtSubscribe on Security Event 4657 pushes the username, domain, and process that made the change.

~200ms

State Evaluation

The service reads the registry, detects transitions, correlates attribution, evaluates the grace period, and appends to the audit store.

in-memory

Instant Query

CLI and PowerShell connect via named pipe. No file I/O, no registry reads. The answer is already computed.

\\.\pipe\drainctl
Highlights
Built for production RDSH farms.
Meanwhile, in the server room…
🔍

Zero-Touch Discovery

One DNS SRV record. Every agent finds the dashboard on its own. No scripts, no per-machine config, no manual URLs.

_drainctl._tcp.contoso.com
The lock clicks shut…
🔒

HTTPS
Everywhere

Auto TLS on first start. Self-signed cert, or bring your own. Certificate pinning. HSTS. Private key locked to SYSTEM.

At the notification desk…
🔔

Target Editor

Add and remove webhook + ntfy targets right in the dashboard. Per-target triggers and repeat intervals.

The cmdlets assemble…
⚡

12 Cmdlets

Add-, Get-, Remove-RDSHDrainNotificationTarget. Full multi-target control from PowerShell.

A familiar face, modernized…
🚀

Go 1.25

Range-over-int, slices, clear(). Event-based config watcher. Faster, leaner, modern.

The installer arrives…
📦

MSI with Superpowers

Interactive wizard or silent deploy. INSTALL_MODE=dashboard, WEBHOOK_URL=... — configure everything from the command line. Setup wizard with install mode selection and RTF license.

Farm Monitoring
One dashboard for your entire RDSH farm.
See every server's drain state, session count, and alert history on a single page. Configure notifications and thresholds once — every agent in the farm inherits them. Enable the dashboard, add one DNS SRV record, done.
DrainCtl Dashboard showing server overview, state history chart, and server cards with session gauges
🔌

One Command Setup

drainctl dashboard enable, add one DNS SRV record, done. Agents discover and register themselves.

🔒

Secure by Default

Auto TLS, Kerberos SSO, certificate pinning, HSTS. No passwords, no login page.

📈

Live Monitoring

State history chart, session gauges, event log, and multi-target notification editor — all in one page.

⚙️

Centralized Config

Set notification targets, grace periods, and session thresholds once in the dashboard. Every agent pulls them automatically — 50 servers, one config.

Dashboard Guide
Usage Guide
CLI, PowerShell, or both.
Every interface returns the same data. Pick the one that fits your workflow.
# Check drain mode status (instant via service pipe) PS> drainctl check 2026-04-02T20:08:56-04:00 [INF] source=service 2026-04-02T20:08:56-04:00 [INF] host=MDS-LDC1-RDS5 2026-04-02T20:08:56-04:00 [INF] drain_mode=ALLOW_ALL_CONNECTIONS value=0 2026-04-02T20:08:56-04:00 [INF] state_since=2026-04-02T18:30:00-04:00 state_duration=1h38m56s 2026-04-02T20:08:56-04:00 [INF] grace_period=1h0m0s 2026-04-02T20:08:56-04:00 [OK ] status=Healthy connections_allowed=true exit=0 # When drain mode is active beyond grace period: 2026-04-02T22:15:00-04:00 [ERR] status=Alert connections_allowed=false exit=1 # Exit code 1 triggers your RMM monitoring threshold
# Rich status object PS> Get-RDSHDrainMode Timestamp : 4/2/2026 8:08:56 PM Host : MDS-LDC1-RDS5 DrainMode : ALLOW_ALL_CONNECTIONS StateSince : 4/2/2026 6:30:00 PM StateDurationSeconds : 5936 Status : Healthy ConnectionsAllowed : True Message : All connections allowed. ExitCode : 0 # Boolean check for scripts and alerts PS> if (Test-RDSHDrainMode) { "OK" } else { "ALERT" } OK # One-liner for monitoring scripts PS> (Get-RDSHDrainMode).Status Healthy
# Machine-readable output for automation PS> drainctl check --format json { "version": "26.95.0", "timestamp": "2026-04-02T20:08:56-04:00", "host": "MDS-LDC1-RDS5", "drain_mode": "ALLOW_ALL_CONNECTIONS", "drain_mode_value": 0, "state_since": "2026-04-02T18:30:00-04:00", "state_duration_seconds": 5936.42, "grace_period_seconds": 3600, "status": "Healthy", "connections_allowed": true, "sessions": { "active_sessions": 12, "disconnected_sessions": 3, "total_sessions": 15, "max_sessions": 25, "utilization_pct": 60 }, "transition": false, "message": "All connections allowed.", "exit_code": 0 }
# View recent state transitions with attribution PS> Get-RDSHDrainHistory -ChangesOnly -Limit 5 Timestamp DrainMode Changed ChangedBy Exit --------- --------- ------- --------- ---- 4/2/2026 10:14:04 PM ALLOW_RECONNECTIONS_PREVENT_NEW... YES MDS\lissadmin 0 4/2/2026 10:13:32 PM ALLOW_ALL_CONNECTIONS YES MDS\lissadmin 0 4/2/2026 10:10:00 PM ALLOW_RECONNECTIONS_PREVENT_NEW... YES MDS\lissadmin 0 4/2/2026 8:30:00 PM ALLOW_ALL_CONNECTIONS YES MDS\svcaccount 0 4/2/2026 6:15:00 PM ALLOW_RECONNECTIONS_PREVENT_NEW... YES MDS\jdoe 0 # Filter in pipeline PS> Get-RDSHDrainHistory | Where-Object Changed | Select Timestamp, ChangedBy
Installation
Three ways to install. Zero guesswork.
Full package via MSI (with interactive configuration wizard), silent install for RMM, or just the PowerShell module from PSGallery. Read the full guide →

📦 MSI Installer

Setup wizard with license acceptance, install mode selection, and configuration options. The recommended way to install interactively.

  • Install mode wizard
  • License acceptance
  • Installs service + CLI + PS module
  • Also supports silent deploy
Download MSI

⚙ MSI (Silent)

Same MSI for RMM, SCCM, Intune, or GPO deployment. No UI — configure everything via properties.

msiexec /i LISSTech.DrainCtl.msi /qn
Download MSI

🐚 PowerShell Gallery

Just the cmdlets — no service, no CLI. Great for quick checks and scripting.

Install-Module LISSTech.DrainCtl
View on PSGallery