• I use windows server 2008R2

I want to see who is currently Logged on a Machine. I used PsLoggedOn \\Machine Name or IP but it gives me the following error:

Error Opening HKEY_USERS for [COMPUTER NAME] Unable to query resource logons

any suggestion?

  • no error number? – tony roth Jul 16 '12 at 13:39
  • not unfortunately! – Mehrdad Kamelzadeh Jul 16 '12 at 13:43
  • did you elevate your command sesson? – tony roth Jul 16 '12 at 16:08
  • I don't know what does it mean to elevate a command session. could you please explain it more? – Mehrdad Kamelzadeh Jul 16 '12 at 20:16
  • 3
    so do you have an account on the remote machine thats equivalent to admin if not you are done then! Done as in there is nothing you can do. – tony roth Jul 20 '12 at 14:21

Use PowerShell:

Get-WmiObject -Class win32_process -ComputerName remote-hostname | 
    Where-Object{ $_.Name -eq "explorer.exe" } | 
    ForEach-Object{ ($_.GetOwner()).Domain + "\\" + ($_.GetOwner()).User; }

...replacing remote-hostname with the computer name.

  • In what way is this better than PsLoggeedOn? – VBwhatnow Aug 1 '12 at 13:54
  • Erm, no brainer, surely? PS/WMI is built into the O/S, whereas PSLoggedIn requires a binary. – Simon Catlin Aug 2 '12 at 22:05

OK, it's hard to tell what exactly applies here, and what doesn't, but check this post at the SysInternals forum, specifically, what I'm going to copy below.

On your target machine check if

... [long list of things I clipped out, as they may not apply here, bringing us to]...

As soon as your target machine meets all of the above listed requirements, from your local machine try to execute these commands to your target machine:

net use \\target\Admin$ /user:Administrator

dir \\target\Admin$

net use \\target\Admin$ /delete

(only disconnects, does not delete anything.)

(They also have resources like a FAQ on the tools and links to the MS download page for the tools, so they're worth a visit for information on or questions about the Sysinternals suite.)

Now, assuming that all those criteria are met, and you can actually execute the three commands above, the most common cause of that error from PSLoggedon is... the Remote Registry Service being disabled. It's disabled by default, but required for PSLoggedon (among other things) to work. Check the services on your target machine, and I bet you'll need to enable it to get this tool working for you.


To start a service remotely with PSExec, you'd use:

psexec \\[target] -u [username with admin rights] -p [password] net start [servicename]

So you could use PSExec to remotely start the required services, then use PSLoggedOn, without having to actually go around to every machine, or deploying a GPO.

  • I need both the remote registry service AND file and printer sharing for psLoggedOn to work. I can set the remote registry service in GPO but nothing about file and printer sharing. It honestly appears to be impossible without going round every machine. – VBwhatnow Aug 1 '12 at 13:53
  • @VBwhatnow Correct, you need both. (And others, that are enabled by default.) If you have a domain, you can set them to be automatically started by GPO, if you don't, you can use another tool (like PSExec) to manually start them. I'll edit that PSExec command into my answer, I suppose. – HopelessN00b Aug 1 '12 at 13:58
  • Could you tell me how to set file and printer sharing via GPO? I cant seem to find it anywhere and google has failed me – VBwhatnow Aug 1 '12 at 14:00
  • @VBwhatnow It depends entirely on what you mean by set file and printer sharing, actually. I'm going to make an assumption, and this is that you're talking about enabling the service that supports this functionality, which is called Server in the services.msc mmc snap-in. (Actual service name is LanmanServer.) To turn that on via GPO, it's under Computer Configuration -> Policies -> Windows Settings -> Security Settings -> System Services, define automatic startup. And you may need to define the corresponding exception in Windows Firewall as well. – HopelessN00b Aug 1 '12 at 15:28

The user context under which the application is running (the Default Network Credentials), needs acces to open and read from the HKEY_USERS hive, on the computers you want to query.

To "elevate the command session", right click the executable (cmd.exe for instance), and choose "Run as Administrator". Now all executables run from that command prompt, will be run with "elevated privileges"

Read more on TechNet about User Account Control, the feature managing token elevation in Windows

  • I did that but again it gives me that error. Let me explain what I am going to do. maybe you can give me a better suggestion. I have two computer A and B. I am working on computer A. and Computer B has different users. these two are on a LAN (same network). I have the IP address of computer B. The question is how can I find which user is currently working on Computer B? Basically is PsloggedOn true tool I am using? – Mehrdad Kamelzadeh Jul 17 '12 at 5:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.