PsLoggedOn - CMD

Overview

PsLoggedOn is a utility tool used in Windows environments to determine the user accounts that are currently logged on locally or via network connections. This command scans both local and network sessions and shows the account details of users who are actively logged in. It is especially useful in administrative tasks such as network audits, security tracking, and system monitoring.

Syntax

The basic syntax of the PsLoggedOn command is as follows:

PsLoggedOn [-l] [-x] [\\computername | username]
  • \\computername : Specifies the target computer name to check for logged on users.
  • username : Checks for sessions using this Username.

Required Arguments

  • There are no mandatory arguments needed to run PsLoggedOn in its simplest form without specific parameters.

Optional Arguments

  • -l : Shows only local logons instead of network connections.
  • -x : Includes extra detailed information.

Options/Flags

  • -l : Use this flag to return information about users logged on locally to the machine, excluding any users connected over the network.
  • -x : Provides detailed information, which can be crucial for troubleshooting or deeper user session analysis.

Examples

Example 1: Finding all users logged on your local computer

PsLoggedOn

This command will display all users logged on both locally and via network connections.

Example 2: Checking who is logged on locally only

PsLoggedOn -l

Using the -l option will limit the display to users who are logged on directly on the local machine.

Example 3: Viewing details on a specific computer in the network

PsLoggedOn \\workstation01

This will show all users logged onto workstation01, both through local logons and network connections.

Common Issues

  • Permissions: The user running PsLoggedOn may need administrative privileges to view details on network computers.
  • Network Issues: Sometimes network problems can prevent PsLoggedOn from accessing another computer, resulting in errors like Error opening HKEY_USERS on <computername>.

Solutions:

  • Ensure the request is run from an account with sufficient privileges.
  • Check network connectivity and permissions if errors persist when accessing remote systems.

Integration

PsLoggedOn can be combined with other commands for broader administrative scripts or tasks:

Example: Creating a log file of user logons

PsLoggedOn >> logons.txt

This script appends the PsLoggedOn output to logons.txt, creating a historical log of user connections.

  • PsTools Suite: PsLoggedOn is part of the larger PsTools suite, which includes several utilities like PsExec, PsKill, and PsList that are useful for system management.

For more detailed information or updates, visit the official PsTools site.

This guide provides a robust foundation for understanding and effectively utilizing the PsLoggedOn command to monitor user activity across a network or local computer, illustrating its importance in administrative and security tasks.