How to remotely see what users are logged into Windows 7 or Vista

Question

I need to login to a remote Win7 or Vista computer but when I connect I get a Logon Message "Another user is currently logged on..." but it does not specify who.

I have a domain username with admin privileges on the computer, how can I see who is logged in?

score 17 · Accepted Answer · answered Jun 17 '11 at 16:02

You can use the commands listed here to manage Terminal Server connections. query session /server:<servername> is probably the first one you want.

These all require remote procedure call, which is part and parcel with CIFS/SMB (the IPC$ share). Check that the RPC service is enabled first. Second, you can't/shouldn't (depending on network configuration) run these services over anything but the local network. If you're trying to do this sort of management over the Internet, you should be using a VPN or some creative SSH tunneling.

@Michael, `query` is not packaged for non-server Windows. Where can do download it? Or is there an alternative? — Pacerier, Mar 20 '15 at 11:06

score 13 · Answer 2 · answered Jan 31 '11 at 15:03

13

Use the eventvwr to remotely view the security log for the remote computer, and scroll through the security logs until you find a login event for the other user:

eventvwr [remote computer name without brackets]

answered Jan 31 '11 at 15:03

Ziplin

485
2
4
16

@Ziplin, I've got access denied. How can I enable access on the server side? – Pacerier Mar 20 '15 at 11:08
filter the event viewer on ID 4624, these represent successful login events – Gunther Struyf Aug 09 '16 at 13:34

score 5 · Answer 3 · edited Jul 25 '14 at 10:20

5

Use this command:

wmic /node:"servername or ip address" computersystem get username

edited Jul 25 '14 at 10:20

zero0

1,407
16
14

answered Jul 25 '14 at 10:02

Martyn Weber

61
1
1

score 4 · Answer 4 · answered Jan 31 '11 at 15:49

Use powershell, MUCH easier, already instealled, no 3rd party tool required:

$computername = 'SomeMachine-or-IP'

Get-WmiObject Win32_ComputerSystem -ComputerName $computername | Select-Object -ExpandProperty UserName

Note that this will always return the user logged on to the physical machine. It will not return terminal service user or users inside a virtual machine. You will need administrator privileges on the target machine. Get-WmiObject supports the -Credential parameter if you must authenticate as someone else.

Very cool. I didn't specify, but it is a remote user who is blocking me from login. Good tip though, Jordan. Thanks! — Ziplin, Jan 31 '11 at 16:06

score 4 · Answer 5 · answered Sep 04 '13 at 05:59

4

Another easy way I find it to UNC connect to the C:\users folder and sort profile by date updated. Bam easy as.

answered Sep 04 '13 at 05:59

Henry

41
1

score 3 · Answer 6 · answered Jan 31 '11 at 15:05

3

You should be able to use Terminal Services Manager. If you don't have this on your machine, you can RDP into a server that has it (any server should) under Control Panel -> Administrative Tools -> Terminal Services Manager. Then, go to Actions and choose "Connect to Computer". That will list all active and inactive sessions and users.

answered Jan 31 '11 at 15:05

Matt

159
2
2
10

1

This just comes back with "Unable to connect to server". Don't know if that's why this got down voted or not. – Ziplin Jan 31 '11 at 16:08
Yeah, I don't know either. I use this all the time to see who didn't log out and to see who is still in a server. – Matt Jan 31 '11 at 16:16

score 3 · Answer 7 · answered Jan 31 '11 at 15:48

3

An easy way to do this would be to use PSLOGGEDON http://technet.microsoft.com/en-gb/sysinternals/bb897545.aspx

from CMD navigate to where you extract the file and run psloggedon \\machinename

OR

Without downloading any software use the following command from CMD

qwinsta /server:[NAME] or [IP]

answered Jan 31 '11 at 15:48

trozz

557
2
12

2

Weird, I get `Error[1722]:The RPC server is unavailable` for qwinsta – Ziplin Jan 31 '11 at 16:05
When you run which one? try seeing if Remote Procedure Call is enabled in the Services of the machine you are attempting to query, you can use MMC to connect to the remote machine and enable the service – trozz Jan 31 '11 at 16:15

score 2 · Answer 8 · answered Jun 06 '11 at 13:48

2

Another option i've thought of recently - use PSExec and get the output of netstat on the remote computer. You can easily get the IPs or hostnames of any remotely connected computers.

answered Jun 06 '11 at 13:48

Ziplin

485
2
4
16

score 2 · Answer 9 · answered May 18 '15 at 17:18

2

We had an issue where no one could log on as the limit was reached, so we used Remote Desktop Services Manager. That allowed us to see who was RDP in and disconnect the user who forgot to log off.

answered May 18 '15 at 17:18

cjwhitt89801

21
1

score -2 · Answer 10 · answered Oct 03 '18 at 22:07

-2

(gwmi -ComputerName [computername] -Class win32_computersystem).username

answered Oct 03 '18 at 22:07

KYLE

1

score -3 · Answer 11 · answered Jul 02 '14 at 10:32

-3

Just login to the remote server by going to mstsc.exe /admin /v:servername you then connect to the admin console this one is never in use

answered Jul 02 '14 at 10:32

user228921

1

This is more about answering how to log in than figuring out who is logged in. – sysadmin1138 Jul 02 '14 at 11:25

How to remotely see what users are logged into Windows 7 or Vista

11 Answers11

Linked