Windows domain, sessions by user

Question

On a Windows domain, given a user name, how do you get a list of machines that the user is currently logged onto (via RDP)?

Answer 1

You don't.

At least not if you don't properly define "logged onto" (RDP? Local console? File share? Printer? Web site? DB?).

And even then, it's quite a difficult task, as there is no central repository for this information; you have to either scan each machine for active sessions or query the security logs on all domain controllers.

There are third-party auditing tools that can track this, but there is no easy built-in way in AD to do it.

Answer 2

We do this the 'easy' way, with logon/logoff scripts, either writing machine name, username and time to a SQL database or file on a 'hidden' AUDIT$ share that Everyone can modify, or changing the Description to the username (used to look good in WinXP Explorer's view of the domain).

It may be even easier to do set the Description, now, with Group Policy Preferences, i.e. adding a user preference to replace HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\srvcomment to be a REG_EXPAND_SZ with value %USERNAME%. It would only work for the last logged-in user though and would probably only be partial for multi-user (e.g. Remote Desktop, Fast User Switching) setups.

Of course, if you are looking for a holistic outside-in approach, you have to examine the Event Logs on each computer -- perhaps with Powershell's Get-EventLog cmdlet. There was a pretty good blog post with what you would need to look for at http://blogs.msdn.com/b/ericfitz/archive/2008/08/20/tracking-user-logon-activity-using-logon-events.aspx.

Answer 3

As others have noted, there is no central database of who is logged in where, etc. However, if you're only concerned with a certain subset of machines, or you can at least enumerate them, then you can use PowerShell to query them to see who is connected.