Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On a Windows domain, given a user name, how do you get a list of machines that the user is currently logged onto (via RDP)?

share|improve this question
add comment

3 Answers

You don't.

At least not if you don't properly define "logged onto" (RDP? Local console? File share? Printer? Web site? DB?).

And even then, it's quite a difficult task, as there is no central repository for this information; you have to either scan each machine for active sessions or query the security logs on all domain controllers.

There are third-party auditing tools that can track this, but there is no easy built-in way in AD to do it.

share|improve this answer
add comment

We do this the 'easy' way, with logon/logoff scripts, either writing machine name, username and time to a SQL database or file on a 'hidden' AUDIT$ share that Everyone can modify, or changing the Description to the username (used to look good in WinXP Explorer's view of the domain).

It may be even easier to do set the Description, now, with Group Policy Preferences, i.e. adding a user preference to replace HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\srvcomment to be a REG_EXPAND_SZ with value %USERNAME%. It would only work for the last logged-in user though and would probably only be partial for multi-user (e.g. Remote Desktop, Fast User Switching) setups.

Of course, if you are looking for a holistic outside-in approach, you have to examine the Event Logs on each computer -- perhaps with Powershell's Get-EventLog cmdlet. There was a pretty good blog post with what you would need to look for at http://blogs.msdn.com/b/ericfitz/archive/2008/08/20/tracking-user-logon-activity-using-logon-events.aspx.

share|improve this answer
add comment

As others have noted, there is no central database of who is logged in where, etc. However, if you're only concerned with a certain subset of machines, or you can at least enumerate them, then you can use PowerShell to query them to see who is connected.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.