Script or program to see who is logged in where in the complete domain

Lennart Giaccotto
Lennart Giaccotto used Ask the Experts™
on
I am in search of a script or (free) program which can tell me who is logged in in one of our systems in the domain. i see a lot of scripts that can tell me for just one system but i want to see it for all systems so i can see if a user is still logged in somewhere
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Chris DentPowerShell Developer
Top Expert 2010

Commented:
How many systems? Something that can say who is logged on everywhere is almost always a problem of scale. If you have 30 computers, it's easy. If you have 5000, the burden of checking is a bit daft.
Chris DentPowerShell Developer
Top Expert 2010

Commented:
Oh and I used to use this, long ago, for a mid-size (500 to 1000 systems) domain to give me an overview:

http://blogs.msmvps.com/kwsupport/2005/02/24/lazy-mans-way-to-track-user-logonlogoff/

It has some limitations, it doesn't trigger when a user is connected via a VPN client for example. A lot depends on the size and nature of your domain.
Lennart GiaccottoAdministrator

Author

Commented:
Thanks for the comment Chris. We are talking about +/- 200 systems. What is am looking for is a program or script who tells me who is logged on at this right moment. We already have auditing which tells me when someone logged in or logged of. i need something like
query user /server:$SERVER

Open in new window

but for all domain members at once without me having to give up the names of the domain members
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Chris DentPowerShell Developer
Top Expert 2010

Commented:
200... it won't be amazingly fast, this makes the request of 50 computers at once. Once they've all finished you'll get a list (from the Receive-Job line).

The list of computers is pulled from Active Directory. It'll include servers at the moment, you might want a better filter.
$threadLimit = 50

Get-ADComputer -Filter { Enabled -eq $true } | ForEach-Object {
    while ((Get-Job -State Running | Measure-Object).Count -ge $threadLimit) {
        Start-Sleep -Seconds 5
    }
    $null = Start-Job -ArgumentList $_.Name -ScriptBlock {
        Get-CimInstance Win32_ComputerSystem -ComputerName $args[0] -Property Name, UserName
    }
}

Get-Job | Wait-Job | Receive-Job | Select-Object Name, UserName
# Tidy up
Get-Job | Remove-Job

Open in new window

E ATech Lead

Commented:
Powershell script to see currently logged in users (domain and machine) + status (active, idle, away):
http://stackoverflow.com/questions/23219718/powershell-script-to-see-currently-logged-in-users-domain-and-machine-status

How to track user logon sessions using event log:
https://community.spiceworks.com/how_to/130398-how-to-track-user-logon-sessions-using-event-log

Track users logon events across the company domain:
https://community.spiceworks.com/how_to/2809-track-users-logon-events-across-the-company-domain

Hope this helps!
Lennart GiaccottoAdministrator

Author

Commented:
Hi Kevin, Thank you for your post. I already looked at this one. The function sounds promising but when i run it i get no output at all.

@crhis: Thanks for the Script. It seems to work :-). The output is a bit cloudy though. Is it possieble to save the output to a txt file so i can search it and maybe to not show the errors?
WinRM cannot process the request. The following error occurred while using Kerberos authentication: Cannot find the computer <COMPUTERNAME>. Verify that the computer exists on the network and that the name provided is spelled correct
ly.
Chris DentPowerShell Developer
Top Expert 2010

Commented:
Upgraded the error handling. It should tell you if something isn't around now. Added two output options (gridview and file).
$threadLimit = 50

Get-ADComputer -Filter { Enabled -eq $true } | ForEach-Object {
    while ((Get-Job -State Running | Measure-Object).Count -ge $threadLimit) {
        Start-Sleep -Seconds 5
    }
    $null = Start-Job -ArgumentList $_.Name -ScriptBlock {
        try {
            Get-CimInstance Win32_ComputerSystem -ComputerName $args[0] -Property Name, UserName -ErrorAction Stop |
                Add-Member State 'OK' -PassThru
        } catch {
            [PSCustomObject]@{
                Name     = $_.Name
                UserName = ''
                State    = 'Failed ({0})' -f $_.Exception.Message.Trim()
            }
        }
    }
}

# Variable assignment to show different output options
$report = Get-Job | Wait-Job | Receive-Job | Select-Object Name, UserName
# Tidy up
Get-Job | Remove-Job

# GridView
$report | Out-GridView
# File
$report | Export-Csv ComputersAndUsers.csv -NoTypeInformation

Open in new window

Lennart GiaccottoAdministrator

Author

Commented:
Powershell on my server seems to crash when i up the limit to 250.
Chris DentPowerShell Developer
Top Expert 2010

Commented:
The thread limit? I'm not surprised, I put it at 50 for a reason :) That's just the number of concurrent requests, it's not the number of machines it'll query in total. It's quite easy to ruin a system by running too many things at once.

I imagine it'll recover, even if it's running 250 simultaneous threads, no fun until it does though.
Lennart GiaccottoAdministrator

Author

Commented:
Ah, that explains a lot :-). Now for the last question. This script seems to only display the username who has executed it. how can i let it search for either all users that are logged in or just a specific one?
Chris DentPowerShell Developer
Top Expert 2010

Commented:
The should show the name of the user logged into the PC using the interactive session. If you want users across all sessions things become a little more complex (that's when you need what quser is doing). Is that what you're looking for?
Lennart GiaccottoAdministrator

Author

Commented:
I need to see all users accross the complete domain that are currently logged on. also when the session is disconnected
Chris DentPowerShell Developer
Top Expert 2010

Commented:
Okay, no problem. One sec.
PowerShell Developer
Top Expert 2010
Commented:
Let's see how this does.
$threadLimit = 50
$regex = '^ *(?<Interactive>\>)?(?<User>\S+) +(?:(?<Session>\S+) +)?(?<ID>\d+) +(?<SessionState>\S+) +(?<IdleTime>\S+) +(?<LogonTime>\S+ \S+)$'

Get-ADComputer -Filter { Enabled -eq $true } | ForEach-Object {
    $computerName = $_.Name

    while ((Get-Job -State Running | Measure-Object).Count -ge $threadLimit) {
        Start-Sleep -Seconds 5
    }
    $null = Start-Job -ArgumentList $computerName, $regex -ScriptBlock {
        param(
            $ComputerName,

            $Regex
        )

        $output = query user /server:$ComputerName 2>&1
        if ($null -ne $output -and $output[1] -is [System.Management.Automation.ErrorRecord]) {
            $_ | Select-Object Name, User, Interactive, Session, ID, SessionState, IdleTime, LogonTime,
                @{n='State';e={
                    'Failed ({0})' -f $output[1].Exception.Message.Trim()
                }}
        } elseif ($null -ne $output) {
            $output | Where-Object { $_ -match $regex } | ForEach-Object {
                [PSCustomObject]@{
                    Name         = $ComputerName
                    User         = $matches.User
                    Interactive  = [Boolean]$matches.Interactive
                    Session      = $matches.Session
                    ID           = $matches.ID
                    SessionState = $matches.SessionState
                    IdleTime     = $matches.IdleTime
                    LogonTime    = Get-Date $matches.LogonTime
                    State        = 'OK'
                }
            }
        }
    }
}

# Variable assignment to show different output options
$report = Get-Job | Wait-Job | Receive-Job | Select-Object * -ExcludeProperty RunspaceId
# Tidy up
Get-Job | Remove-Job

# GridView
$report | Out-GridView
# File
$report | Export-Csv ComputersAndUsers.csv -NoTypeInformation

Open in new window

To search it the output needs to be filtered, searching doesn't really affect what it must do before that. A filter might be like:
$report | Where-Object User  -eq 'someone'

Open in new window

Or:
$report | Where-Object { $_.User -eq 'soemone' -and $_.SessionState -ne 'Active' }

Open in new window

Lennart GiaccottoAdministrator

Author

Commented:
Yes! This works beautiful! It gives me a complete list of users logged in anywhere in the domain! Thank you!
Lennart GiaccottoAdministrator

Author

Commented:
This Script does exactly what i ask. it shows me every user that is logged in somwhere within the domain

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial