View logged-on users using CMD

The simplest way to view logged in users is by using the query user command.

• Open Command Prompt as administrator.
• Run the following command:

  Sample Windows PowerShell script

  Copy

  query user

This will display the usernames, session IDs, and session states of Logged-in users. It's a straightforward way to see logged-in users without extra tools.

• To filter only the users who are currently logged in and active, run:

  Sample Windows PowerShell script

  Copy

  query user | findstr "Active"

The columns in the output represent the following:

1. SESSIONNAME
   • Shows the type of session. For RDP, you'll see something like rdp-tcp#0.
   • If it's blank, the session is a disconnected session not actively tied to a console or RDP.
2. ID
   • The session ID assigned by Windows.
   • Each login session gets a unique numeric ID.
   • Used when running commands like logoff <ID> or reset session <ID>.
3. STATE
   • Active: The user is currently logged in and using the session.
   • Disc (disconnected): The user was logged in but has disconnected the RDP or console session (still consuming resources but not actively connected).
   • Listen: A system listener waiting for new RDP connections.
   • Down: The session is not functioning correctly.
   • Idle: The session has had no input activity for a long time (usually shown through IDLE TIME rather than this column).
4. IDLE TIME
   • The duration the session has been inactive (no keyboard or mouse input).
   • Format: Days+HH:MM
   • Example: 1+20:40 = 1 day, 20 hours, 40 minutes of inactivity
   • A . (dot) means there's no idle time (the user is currently active).

net user

net user < username>

View logged-on users using PowerShell

PowerShell offers multiple ways to check logged-in users. Depending on your needs, you can view the current console user, all active sessions, or export results for reporting.

• Check the current logged-In console user by running:

  Sample Windows PowerShell script

  Copy

  Get-CimInstance Win32_ComputerSystem | Select-Object UserName

  On older versions like Windows Server 2008 R2, replace Get-CimInstance with:

  Sample Windows PowerShell script

  Copy

  Get-WmiObject Win32_ComputerSystem | Select-Object UserName

  • This displays the currently active console user.
  • Limitation: It only shows the user physically logged in at the machine, not remote RDP sessions.
• List all active sessions by running:

  Sample Windows PowerShell script

  Copy

  quser

  • This works similarly to query user in CMD.
  • It lists all users logged in locally and via RDP, including their session ID, state, and idle time.
• To filter only active users, run:

  Sample Windows PowerShell script

  Copy

  quser | Select-String "Active"

  

Export logged-on users to CSV

You can export results for reporting or auditing by running:

quser | ForEach-Object {
    $parts = ($_ -split "\s+", 6)
    [PSCustomObject]@{
        UserName    = $parts[0]
        SessionName = $parts[1]
        ID          = $parts[2]
        State       = $parts[3]
        IdleTime    = $parts[4]
        LogonTime   = $parts[5]
    }
} | Export-Csv -Path "C:\LoggedInUsers.csv" -NoTypeInformation

• This creates a CSV file in the given path location with user details.

Once exported, the CSV file can be opened in Excel or any reporting tool for deeper analysis.

This allows administrators to sort, filter, and archive login records, making it easier to track trends, investigate suspicious activity, or share reports with management and auditors.

View logged-on users with Task Manager

If you prefer a graphical method to view logged-in users, Task Manager provides a quick way to check who's logged in.

• Right-click the taskbar and select Task Manager.
• If you're using Windows 10 or 8, you might need to click the More details button located at the bottom to see active processes.
• Click the Users tab at the top of Task Manager; here, you can see the list of currently logged-on users and their status.

Simplify the way you see logged-on users

1. Download and install ADAudit Plus.
2. Find the steps to configure auditing on your domain controller here.
3. Open the console and navigate to Active Directory → Local Logon-Logoff → Currently Logged on Users

   

4. Audit recent user logon activity by navigating to Active Directory → Local Logon-Logoff → Recent User Logon Activity.