Q: How can I see which users are currently logged on and what programs they’re currently running? I’ve found various tools, such as the Sessions folder in the Microsoft Management Console (MMC) Computer Management snap-in that displays network logon sessions and the Terminal Services Management snap-in that shows remote desktop logons, but nothing that shows me every logon session—regardless of the logon type—or a list of programs that these users are currently running.
A: I think you’ll love the LogonSessions tool (http://www.microsoft.com/technet/sysinternals/Security/LogonSessions.mspx) from Sysinternals (which is now part of Microsoft). LogonSessions displays every single logon process, including those of the local system account and network logons from other computers on the network (common on domain controllers). For each logon session, you’ll get the username, authentication package used, logon type, SID of the user account, date and time of the logon, and domain name of the user account. If you run LogonSessions with the -p switch, you’ll also get a list of all the active processes running in each logon session. Figure 1 shows some sample LogonSessions output. . . .
Register
