Any way to see who's logged in?

Is there any (simple) way to see which users have logged into a Windows Server 2003 network and also which workstation(s) they're on?
Who is Participating?
Rob WilliamsConnect With a Mentor Commented:
Sysinternals has a great little free utility that allows you to check who is logged into a particular machine, or what machines a particular user is logged into:
rsivanandanConnect With a Mentor Commented:
Rob has a good tool there; But if you want to have a list of who all are logged on, then you'll have to check Event Viewer.

If there is any specific requirement, then please elaborate.

HDatabase AdministratorCommented:
click windows start button
then run then
then type CMD

then use the dos command


this will list all the current connection to any networked system


to get detailed info
Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

HDatabase AdministratorCommented:
I just reread your question...Are you looking to find out all the users that are currenty authenicated in the entire network?  Do you have a network domain?
acksisAuthor Commented:
Yes - I'm looking to see which users have authenticated to the domain, which computer that user is on, and if possible, when that user has logged in.
I know that i could dig through the Event Viewer logs but that isn't exactly simple solution.

I was hoping that someone knew of a simple command line script or gui tool that would be able to enumerate the users that have authenticated to the domain controller and which workstations they're one.

I'm going to check out the SysInternals tool but from what I've read that may not have all of my answers.
Rob WilliamsCommented:
I would think PSLoggedOn would do what you want. It will tell you computer name, user name, time, and for local and/or network resource logons.
HConnect With a Mentor Database AdministratorCommented:

Basically when a user logs into the network they authenticate with the domain controller.  An event is logged then the connection is actaully dropped.  So to get that info the only method would be to look at logs...Hence the comment above to look at event viewer.  One issue with looking at the evet viewer is you would need to compare log off and logon times.  Also the users makeing connectiosn to other application, server, and systems on the network would not necisarily be logged in one place.

So there is no easy windows console or tool or script that is  really gonna give you what you need...  So your only solution may be to try some of the programs mentioned above or search the web for something better.  Maybe something that logs network traffic and parses it or filters it to your specifications...
i am with Robwill, pslogged on is simple and easy and does exactly what you ask
HDatabase AdministratorCommented:
Yes I agree also with Robwill...A 3rd party tool is the only solution here...Like I said above...
acksisAuthor Commented:
I appreciate everyone's input.  I've bumped up the points so I can split them out to the three major contributors.

I'm actually going to see if I can write up a little HTA that will scan the log files on my two domain controllers and output exactly what I need.

Thanks again to everyone.
Rob WilliamsCommented:
>>"see if I can write up a little HTA "
You are a better man than I, but if you have programming skills, it is an excellent way to go.

ps- if you want this on an on going basis, have a look at the option to add to a batch file, to create a log with that information in another post of mine.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.