When I was asked if there was a way to determine who was logged on to a domain, without inspecting the Security event logs for audited log on and log off events, I had forgotten that I had scripted WhoDom.bat.

Using the NET VIEW command, and Psloggedon freeware, I scripted a new WhoDom.bat to return the computer name, log on date / time, and user name of all users currently logged on to the same domain as the user running WhoDom.bat from their workstation.

WhoDom.bat requires no parameters.

WhoDom.bat contains:

@echo off                              setlocal ENABLEDELAYEDEXPANSION                              set dom=%USERDOMAIN%                              for /f "Tokens=1" %%c in ('net view /domain:%dom%^|findstr /L /C:"\\"') do (                               for /f "tokens=*" %%u in ('psloggedon -L %%c^|findstr /L /C:"/"') do (                                set work1=%%u                                call set work2=!!work1:%dom%=!!                                if "!work2!" NEQ "!work1!" @echo %%c %%u                                )                              )                              endlocal                              

Sample output:

\\JSI001 08/18/2004 18:46:39    JSIINC\Alisa                              \\JSI005 08/21/2004 06:23:16    JSIINC\Richard                              \\JSI007 08/28/2004 18:51:36    JSIINC\Jennifer                              \\JSI009 08/28/2004 18:52:03    JSIINC\Jerry