{"id":59,"date":"2013-04-24T13:04:08","date_gmt":"2013-04-24T09:04:08","guid":{"rendered":"http:\/\/use-powershell.com\/?p=59"},"modified":"2013-09-18T15:05:19","modified_gmt":"2013-09-18T11:05:19","slug":"get-a-list-of-machine-names-and-logged-in-users","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/powershell\/get-a-list-of-machine-names-and-logged-in-users\/","title":{"rendered":"Get a list of machine names and logged on or active user(s)"},"content":{"rendered":"

The Win32_LoggedOnUser<\/code> class gives a list of logged on users to a computer. It isn’t just users logged on interactively to the console or Remote Desktop (which is a good thing) but even users connected remotely via shared folders and such (not a good thing). <\/p>\n

But just for the curious (and since I fiddled with it today) here’s how you can format the output of this class properly. <\/p>\n

You can use PowerShell to get instances of this class via the Get-WMIObject<\/code> cmdlet thus:<\/p>\n

\r\ngwmi Win32_LoggedOnUser\r\n<\/pre>\n
The output has a lot of material, so best to filter by the Antecedent<\/code> property. <\/p>\n
\r\ngwmi Win32_LoggedOnUser | ft Antecedent\r\n<\/pre>\n
Instead of Format-Table<\/code> you may use Select-Object<\/code> or anything else you fancy. <\/p>\n
To query remote computers using the -ComputerName<\/code> switch. <\/p>\n
\r\nPS> gwmi Win32_LoggedOnUser -ComputerName GARFIELD | Select-Object Antecedent\r\n.rootcimv2:Win32_Account.Domain=\"GARFIELD\",Name=\"SYSTEM\"\r\n.rootcimv2:Win32_Account.Domain=\"GARFIELD\",Name=\"LOCAL SERVICE\"\r\n.rootcimv2:Win32_Account.Domain=\"GARFIELD\",Name=\"NETWORK SERVICE\"\r\n.rootcimv2:Win32_Account.Domain=\"MYDOMAIN\",Name=\"xrakheshx\"\r\n.rootcimv2:Win32_Account.Domain=\"MYDOMAIN\",Name=\"xrakheshx\"\r\n.rootcimv2:Win32_Account.Domain=\"MYDOMAIN\",Name=\"xrakheshx\"\r\n.rootcimv2:Win32_Account.Domain=\"MYDOMAIN\",Name=\"xrakheshx\"\r\n.rootcimv2:Win32_Account.Domain=\"MYDOMAIN\",Name=\"xrakheshx\"\r\n.rootcimv2:Win32_Account.Domain=\"MYDOMAIN\",Name=\"user1\"\r\n.rootcimv2:Win32_Account.Domain=\"MYDOMAIN\",Name=\"user1\"\r\n.rootcimv2:Win32_Account.Domain=\"MYDOMAIN\",Name=\"user1\"\r\n.rootcimv2:Win32_Account.Domain=\"GARFIELD\",Name=\"ANONYMOUS LOGON\"\r\n<\/pre>\n
The output isn’t precise. You get a list of local accounts as well, and there are repeat entries. <\/p>\n
In my case I want to limit to the domain accounts. Also I want to skip accounts starting and ending with the “x” character (as these are my admin accounts) and any accounts entering with a “$” character (as these are machine accounts). And I want to eliminate the duplicates. So here’s what I did:<\/p>\n
\r\ngwmi Win32_LoggedOnUser -ComputerName GARFIELD | `\r\nwhere-object { (($_.Antecedent -match \"MYDOMAIN\") -and ($_.Antecedent -notmatch '.*Name=\"x.+x\"') -and ($_.Antecedent -notmatch '.*$')) } | `\r\n%{ $_.Antecedent -replace '.*Name=\"(.*)\"','$1' } | select-object -Unique\r\n<\/pre>\n
Once again, the beauty of PowerShell is that you can glue things together. So, for instance, if I want to get a list of machines in my domain along with the currently logged in users, I can do that. <\/p>\n
To get a list of machines in a particular OU I use the following (this requires the ActiveDirectory<\/code> module to be imported first!):<\/p>\n
\r\nGet-ADComputer -SearchBase \"OU=Muscat,OU=Win_7,OU=computers,DC=rakhesh,DC=com\" -Filter *\r\n<\/pre>\n
I already have the code for getting the logged in user on a machine, so all I need to do is pipe the output of the Get-ADComputer<\/code> to Format-Table<\/code> and tell it to populate the user column dynamically. Like thus:<\/p>\n
\r\nGet-ADComputer -SearchBase \"OU=Muscat,OU=Win_7,OU=computers,DC=rakhesh,DC=com\" -Filter * | `\r\nft Name,@{Name=\"Logged in User\"; Expression={ gwmi Win32_LoggedOnUser -ComputerName $_.Name | where-object { (($_.Antecedent -match \"MYDOMAIN\") -and ( $_.Antecedent -notmatch '.*Name=\"x.+x\"') -and ($_.Antecedent -notmatch '.*$')) } | %{ $_.Antecedent -replace '.*Name=\"(.*)\"','$1' } | select-object -Unique } }\r\n<\/pre>\n
The code within the Expression<\/code> block is similar to the code for querying a single machine, except that I replace the machine name with $_.Name<\/code>. <\/p>\n
The output is a list of machines with the logged in user(s). If there are no logged in users that field is empty {}<\/code> else it’s a single user name or a list of user names. <\/p>\n
Of course, the Win32_LoggedOnUser<\/code> class isn’t useful if users access each other’s machines via shared folders and such; but in that case it’s just a matter of replacing the Expression<\/code> block above with code that gives more focussed results. Two great posts on how to list logged in users on a machine are this<\/a> and this<\/a>. <\/p>\n
I wanted to expand the code above to also include IP addresses too. A PowerShell one-liner to get IP address from a name<\/a> is the following:<\/p>\n
\r\nPS> [System.Net.Dns]::GetHostAddresses(\"www.msn.com\")\r\n\r\nIPAddressToString : 207.68.173.76\r\nAddress           : 1286423759\r\nAddressFamily     : InterNetwork\r\nScopeId           :\r\nIsIPv6Multicast   : False\r\nIsIPv6LinkLocal   : False\r\nIsIPv6SiteLocal   : False\r\n<\/pre>\n
To limit the output to just the IP address do the following:<\/p>\n
\r\nPS> [System.Net.Dns]::GetHostAddresses(\"www.msn.com\") | Select IPAddressToString -ExpandProperty IPAddressToString\r\n<\/pre>\n
And to restrict to just IPv4 addresses add the following:<\/p>\n
\r\nPS> [System.Net.Dns]::GetHostAddresses(\"www.msn.com\") | where-object { $_.AddressFamily -eq \"InterNetwork\" } | Select IPAddressToString -ExpandProperty IPAddressToString\r\n<\/pre>\n
Going by these it’s pretty obvious what we have to do to add an IP address column:<\/p>\n
\r\nGet-ADComputer -SearchBase \"OU=Muscat,OU=Win_7,OU=computers,DC=rakhesh,DC=com\" -Filter * | `\r\nft Name,@{Name=\"Logged in User\"; Expression={ gwmi Win32_LoggedOnUser -ComputerName $_.Name | where-object { (($_.Antecedent -match \"MYDOMAIN\") -and ( $_.Antecedent -notmatch '.*Name=\"x.+x\"') -and ($_.Antecedent -notmatch '.*$')) } | %{ $_.Antecedent -replace '.*Name=\"(.*)\"','$1' } | select-object -Unique } },@{Name=\"IP Address\"; Expression={ [System.Net.Dns]::GetHostAddresses($_.Name) | where-object { $_.AddressFamily -eq \"InterNetwork\" } | Select IPAddressToString -ExpandProperty IPAddressToString } }\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
The Win32_LoggedOnUser class gives a list of logged on users to a computer. It isn’t just users logged on interactively to the console or Remote Desktop (which is a good thing) but even users connected remotely via shared folders and such (not a good thing). But just for the curious (and since I fiddled with … Continue reading Get a list of machine names and logged on or active user(s)<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[2],"tags":[18,23,25,26,34,37,38],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/59"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=59"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/59\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=59"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=59"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=59"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}