I would like to know if it is posible to get the current usernames of remotely logged in users on a computer? From windows cmd?

Kind of: WMIC /NODE:ComputerName ComputerSystem Get Username

This command works, but gives the users logged in locally to ComputerName. Not the ones who are remotely logged in.

Thank you for your help!

  • Maybe duplicate with this question: serverfault.com/questions/32633/… – cuonglm Sep 25 '13 at 17:46
  • I don't think so, because as I said the command used in this post gives the usernames logged in locally. I am looking for knowing the users logged in remotely (if possible to do so). – Vince Sep 25 '13 at 18:03
  • What version of Windows? – Ryan Ries Sep 25 '13 at 18:04
  • It is Windows 7 – Vince Sep 25 '13 at 18:10

I use this one for my environment, modified slightly to just pull the filter of only the computers I want. It came out sometime last year I think...works well enough for me on 2008 R2. Haven't tested it on 2012 though. I just have it scheduled to run daily.


# Import the Active Directory module for the Get-ADComputer CmdLet 
Import-Module ActiveDirectory 

# Get today's date for the report 
$today = Get-Date 

# Setup email parameters 
$subject = "ACTIVE SERVER SESSIONS REPORT - " + $today 
$priority = "Normal" 
$smtpServer = "YourMailServer" 
$emailFrom = "email@yourdomain.com" 
$emailTo = "email@yourdomain.com" 

# Create a fresh variable to collect the results. You can use this to output as desired 
$SessionList = "ACTIVE SERVER SESSIONS REPORT - " + $today + "`n`n" 

# Query Active Directory for computers running a Server operating system 
$Servers = Get-ADComputer -Filter {OperatingSystem -like "*server*"} 

# Loop through the list to query each server for login sessions 
ForEach ($Server in $Servers) { 
    $ServerName = $Server.Name 

    # When running interactively, uncomment the Write-Host line below to show which server is being queried 
    # Write-Host "Querying $ServerName" 

    # Run the qwinsta.exe and parse the output 
    $queryResults = (qwinsta /server:$ServerName | foreach { (($_.trim() -replace "\s+",","))} | ConvertFrom-Csv)  

    # Pull the session information from each instance 
    ForEach ($queryResult in $queryResults) { 
        $RDPUser = $queryResult.USERNAME 
        $sessionType = $queryResult.SESSIONNAME 

        # We only want to display where a "person" is logged in. Otherwise unused sessions show up as USERNAME as a number 
        If (($RDPUser -match "[a-z]") -and ($RDPUser -ne $NULL)) {  
            # When running interactively, uncomment the Write-Host line below to show the output to screen 
            # Write-Host $ServerName logged in by $RDPUser on $sessionType 
            $SessionList = $SessionList + "`n`n" + $ServerName + " logged in by " + $RDPUser + " on " + $sessionType 

# Send the report email 
Send-MailMessage -To $emailTo -Subject $subject -Body $SessionList -SmtpServer $smtpServer -From $emailFrom -Priority $priority 

# When running interactively, uncomment the Write-Host line below to see the full list on screen 

Since everyone else is throwing in their hat on this one, I guess I might as well too.

I have been using what @TheCleaner suggested with the qwinsta.exe to monitor active users on Terminal Servers but that only outputs in text.

But I've recently discovered the Win32_UserProfile class which is very promising as I can now output in objects to use in PS.

This is what I've got so far:

Get-WmiObject Win32_Profile -ComputerName $Name -Filter "Loaded='True'" | Foreach {$_.LocalPath}

**Note: You may need to filter some "Loaded" Profiles by discarding all results in which the $_.LocalPath value is not in the C:\Users folder.


If it doesn't have to run from cmd ... I use an awesome little util called NetScan to do this for me.

NetScan Link


One easy solution is to enumerate the instances of EXPLORER.EXE running on the remote host. Then just pull the owning user.

Example PS command:

Get-WmiObject -Class Win32_Process -Filter "Name='explorer.exe'" -ComputerName "REMOTECOMPUTER" | ForEach-Object{ "{0}\{1}" -f $_.GetOwner().Domain, $_.GetOwner().User }
  • This implies they have explorer.exe running. This wouldn't be the case of they were remoted in via command line or some other way. – Michael Bailey Jul 15 '15 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.