Remotely check if a user is working on a computer

Question

is there a way to check remotely if a user is working at a computer? ("psloggedon" just lets me know a user is logged-on and nothing else)

Answer 1

It depends on your definition of 'working on' the computer.

You can use the tasklist /S command to connect to a remote computer and see which processes are running on it, and you can combine this with a filter for a username, if you know which user to check on:

C:\Documents and Settings\adam>tasklist /FI "USERNAME eq NTDOM\joe.bloggs" /S REMOTEPC

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
rdpclip.exe                   5808 RDP-Tcp#2                  2      5,132 K
explorer.exe                   656 RDP-Tcp#2                  2     15,228 K
AClntUsr.EXE                  6804 RDP-Tcp#2                  2      4,252 K
cpqteam.exe                   6244 RDP-Tcp#2                  2      3,608 K
ctfmon.exe                    4300 RDP-Tcp#2                  2      3,448 K
ctfmon.exe                    3780 RDP-Tcp#2                  2      2,764 K
shstat.exe                    6836 RDP-Tcp#2                  2        788 K
cmd.exe                       4168 RDP-Tcp#2                  2      2,352 K
logon.scr                     6360 RDP-Tcp#2                  2      2,572 K

I can see which programs "joe" is running. One of them is logon.scr, so I guess he's not doing much at the moment. However, he has cmd.exe running, so he probably was doing something on there at some point. If it were, say, winword.exe (MS word) or excel.exe (MS Excel) - I'd definitely not want to remotely reboot his computer, even if logon.scr was running. He might not have saved all his work.

If you don't know which user you're looking for, you could maybe use the filter "USERNAME ne SYSTEM". If you're scripting this, you could take the username from the output of wmic ComputerSystem Get UserName.

If you just want to know if users are busy clicking things and pressing keys, you can use quser.exe:

C:\scripts>quser
 USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
>adam.thompson         console             1  Active      none   07/03/2012 11:42

I'm not sure how accurate the IDLE TIME bit is in quser when the session is 'console' and refers to a user physically sat at the computer (as opposed to having used terminal services with a /console switch), though.

Be careful with using things like VNC to determine what's happening on a computer. There's privacy and (depending on where you are) legal concerns around such things.

Answer 2

One way would be to set up a VNC server on that machine, remotely log in to it and simply observe screen activity. I use UltraVNC for something similar.