1

i want to know how to find list of domain users whcih entered at my PC (some local groups included domain groups and domain users can enter at my PC).

Xaver
  • 249
  • 2
  • 12

2 Answers2

2

There's more than one way to do this.

  1. The first and easyer one is to go to the "system" settings (in the control pannel or press Windows+Pause). The list of all the accounts that have been used to log in on the computer can be found in the "Advanced" tab, in the "User Profile" section. But this can't be scripted.
  2. You can also check the list of the profile user by looking in the good directory (C:\Users or C:\Documents and Settings according to your system). But if several users have the same username in various environment you won't be able to determine wich domain the user logged from except by checking the ACL on the home profile folder.
  3. Last you can script this using WMI, using the "win32_loggedonuser" class. Here is a small script generated by Scriptomatic V2:
On Error Resume Next

Const wbemFlagReturnImmediately = &h10
Const wbemFlagForwardOnly = &h20

arrComputers = Array("localhost")
For Each strComputer In arrComputers
   WScript.Echo
   WScript.Echo "=========================================="
   WScript.Echo "Computer: " & strComputer
   WScript.Echo "=========================================="

   Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
   Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_LoggedOnUser", "WQL", _
                                          wbemFlagReturnImmediately + wbemFlagForwardOnly)

   For Each objItem In colItems
      WScript.Echo "Antecedent: " & objItem.Antecedent
      WScript.Echo "Dependent: " & objItem.Dependent
      WScript.Echo
   Next
Next
Benoit
  • 3,499
  • 1
  • 18
  • 17
  • in wmi just "win32_loggedonuser" class to know this information? – Xaver Apr 19 '10 at 02:41
  • i also like first way but how to do that on script or programm, and in this window there is Roaming Profile, that is it, and how use it? – Xaver Apr 19 '10 at 05:10
  • @Xaver As far as I know you can't script the first way, but once you get the login and domain name from the wmi script, you may use them to get additional informations like the profile type. – Benoit Apr 22 '10 at 17:18
0

Under C:\Users is a directory for every user that ever logged onto that machine.

Besides that you could check the Eventlogs.

Tie-fighter
  • 741
  • 2
  • 9
  • 17