Manage And Monitor Users From The Commandline

Updated 803 Days AgoPublic

Actions

It's often nice to be able to see what's going on and modify things in regards to users without having to use the GUI, especially because (barring expensive and finicky Windows Server multi-user licensing) Windows remains incapable of what UNIX-based systems have been doing before perhaps anyone who will ever read this wiki article was born, ie. allow more than one GUI user session to be accessed at once (this is a very artificial limitation, yet also a very inflexible one).

Who's logged in and how?

The simplest listing is just via the classic query user command:

$ query user
 USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
 keith                                     1  Disc      1+05:17  9/7/2022 5:59 PM
 doug                  rdp-tcp#0           3  Active       7:54  9/8/2022 11:38 AM

For a history, you gotta go to crazy PowerShell one-liners or such, ex. for remote login history

Get-WinEvent -MaxEvents 6 -LogName 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' | Format-List -Property *