Using NETDOM from the Server Support Tools and Psloggedon freeware, I have scripted WhoDom.bat to generate a file of all domain users who have logged onto your domain from a domain computer.

The syntax of the report file is similar to:

JSI007 05/30/2003 21:23:42    JSIINC\Jennifer                              JSI009 06/02/2003 06:35:33    JSIINC\Jerry
Where JSI007 is a computer name, JSIINC\Jennifer is the domain user logged on from JSI007, and 05/30/2003 21:23:42 is the date / time when JSIINC\Jennifer logged on.

The syntax for using WhoDom.bat is:

WhoDom NetBIOSDomainName ReportFile User Password


NetBiosDomainName is the NetBIOS domain name of the domain your are querying, like JSIINC.

ReportFile is the report file, like WhoDom.TXT or \\Server\ShareName\WhoDom.log.

User is the User ID that has permissions to run Netdom.exe on the NetBIOSDomainName domain, and has RWXD permissions on ReportFile.

Password is the password of User.

NOTE: See Another way to determine who is currently logged on to your domain.

WhoDom.bat contains:

@echo off                              setlocal                              if \{%4\}==\{\} goto syntax                              set domain=%1                              set report=%2                              set user=%3                              set password=%4                              set domain=%domain:"=%                              set user=%user:"=%                              set password=%password:"=%                              if exist %report% del /q %report%                              for /f "skip=1 Tokens=1" %%u in ('netdom.exe query /domain:"%domain%" /UserD:"%user%" /PasswordD:"%password%" DC') do call :computer "%%u"                              for /f "skip=1 Tokens=1" %%u in ('netdom.exe query /domain:"%domain%" /UserD:"%user%" /PasswordD:"%password%" SERVER') do call :computer "%%u"                              for /f "skip=1 Tokens=1" %%u in ('netdom.exe query /domain:"%domain%" /UserD:"%user%" /PasswordD:"%password%" WORKSTATION') do call :computer "%%u"                              endlocal                              goto :EOF                              :syntax                              @echo Syntax: WhoDom NetBIOSDomainName ReportFile User Password                              endlocal                              goto :EOF                              :computer                              set machine=%1                              set machine=%machine:"=%                              if "%machine%" EQU "The" goto :EOF                              if "%machine%" EQU "Directory" goto :EOF                              for /f "Skip=1 Tokens=*" %%l in ('psloggedon "\\%machine%" -l^|Find /v "                              goto:EOF                              :who                              call set work=%%line:%domain%=%%                              if "%work%" EQU "%line%" goto :EOF                              @echo %machine% %line%>>%report%
See What domain computers do not currently have domain users logged on?