How to List Currently Logged-on Users on Windows

Keeping track of who’s logged into a Windows machine is crucial for system administrators, IT support teams and cybersecurity experts. Whether you’re monitoring user activity, troubleshooting access problems, or conducting regular audits, having a clear view of active user sessions can save you time and help avoid potential security issues.

This guide will walk you through various built-in methods and tools to quickly check who’s logged on in Windows

Why Check Currently Logged-on Users?

1. Monitor Active Sessions: Find out who’s using the system right now.
2. Troubleshoot Issues: Help diagnose any login problems or performance hiccups.
3. Security Checks: Make sure there’s no unauthorized access happening.

Methods to List Currently Logged-on Users

1. Using Task Manager

1. Press Ctrl + Shift + Esc to launch the Task Manager.
2. Click on the Users tab.
3. You’ll see a list of logged-on users, along with their session types and statuses (like active or disconnected).

2. Using Command Prompt

1. Open Command Prompt:
   • Press Win + R, type cmd, and hit Enter.
2. Use these commands:
   • query user: This shows you the list of active sessions and users.
   • whoami: This command shows the username of the user currently logged in.
   • net user: This lists all user accounts on the system, but it won’t tell you who’s logged on.

3. Using PowerShell

1. Open PowerShell: -
   • Press Win + R, type powershell, and hit Enter.
2. Run this command:

Get-WmiObject -Class Win32_ComputerSystem | Select-Object -ExpandProperty UserName

This will show you the currently logged-in user on the console session.

4. Using Event Viewer

1. Press Win + R, type eventvwr, and then hit Enter.
2. Navigate to:
   • Windows Logs > Security.
3. Look for Event ID 4624 (logon events) to see who logged in, and Event ID 4647 for logoff events.

5. Using Sysinternals Tools

1. Download and install Sysinternals tools from Microsoft if you haven’t already.
2. Use the PsLoggedOn tool:
   1. Open Command Prompt.
   2. Run "psloggedon" to see currently logged-on users, both locally and remotely.

6. Using Remote Desktop Services (RDS)

• If you’re using an RDS server or session host, you can use the Remote Desktop Services Manager or the `qwinsta` command to list

qwinsta

Final Thoughts

Keeping track of logged-in users is pretty simple once you know the right tools to use. Whether you like to use Task Manager for a quick overview, command-line tools for some scripting magic, or Event Viewer for those in-depth logs, Windows has a variety of options to meet your needs. By incorporating these techniques into your regular system checks, you can enhance your troubleshooting efficiency and strengthen your organization’s security posture.