Videos
Why is it important to check who is logged in?
What’s the difference between net user and query user?
Why does query user return no results on Windows 10 Home?
I typically type in the computer host name in SCCM and can usually see which User is currently logged in or logged in last. But for some computers, that info is unavailable. I can ping the computer but can’t see who’s logged in.
You can use the Terminal Services query command for this.
query session /server:remote_computer_name_here
Note that you will need to set the following registry value on the remote computer:
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
Value Name: AllowRemoteRPC
Value: 1
Type: REG_DWORD
You could put the query command in a batch file, so users can just double click it to see who is logged into that computer.
You could use the Windows Sysinternals tool PSLoggedOn.
Usage: psloggedon [- ] [-l] [-x] [\\computername | username]
- Displays the supported options and the units of measurement used for output values.
-l Shows only local logons instead of both local and network resource logons.
-x Don't show logon times.
\\computername Specifies the name of the computer for which to list logon information.
username If you specify a user name PsLoggedOn searches the network for computers to which that user is logged on. This is useful if you want to ensure that a particular user is not logged on when you are about to change their user profile configuration.
This is the original source.
They suggest using the (Windows Management Interface Command) WMIC which available on windows :
WMIC /NODE: xxx.xxx.xxx.xxx COMPUTERSYSTEM GET USERNAME
Will return the username currently logged into xxx.xxx.xxx.xxx, or
WMIC /NODE: "workstation_name" COMPUTERSYSTEM GET USERNAME
will return the username currently logged into "workstation_name"
UPDATE: This should working on Windows 10 too - if you are an admin on the remote machine.
Sorry, did not notice you do not want to use Sysinternals.
That is now a Microsoft technet tool, any specific reason to not use it?
I have preferred Sysinternals over other third party tools before Mark Russinovich moved into Microsoft.
The Microsoft Sysinternals Suite has a tool called Psloggedon,
psloggedon.exe -l
There is also NBTSTAT,
nbtstat -a NetBIOS-Computer-NAme
I am trying to account for missing laptops in our company that have been loaned out to users over time and we have accounted for all but two. Just by using active directory, I can see that these two specific computers have logged onto our network recently but I can’t figure out WHO last logged into these machines. What would be the simplest way to determine this information? I’ve tried a couple of cmd prompts but the computers are not currently connected to the network/are turned off. Would a GPO auditing logon/logoff events be the easiest route to go just for two computers?
You could always check c:\users and see what profiles are there and see if there’s any recently modified file.
