Q: How can I see which users are currently logged on and what programs they’re currently running? I’ve found various tools, such as the Sessions folder in the Microsoft Management Console (MMC) Computer Management snap-in that displays network logon sessions and the Terminal Services Management snap-in that shows remote desktop logons, but nothing that shows me every logon session—regardless of the logon type—or a list of programs that these users are currently running.
A: I think you’ll love the LogonSessions tool (http://www.microsoft.com/technet/sysinternals/Security/LogonSessions.mspx) from Sysinternals (which is now part of Microsoft). LogonSessions displays every single logon process, including those of the local system account and network logons from other computers on the network (common on domain controllers). For each logon session, you’ll get the username, authentication package used, logon type, SID of the user account, date and time of the logon, and domain name of the user account. If you run LogonSessions with the -p switch, you’ll also get a list of all the active processes running in each logon session. Figure 1 shows some sample LogonSessions output.
You can correlate the codes displayed in LogonSessions with information from other utilities. For example, LogonSessions provides the process ID (PID) of each program, which corresponds to the PID column in the Processes tab of Task Manager. Making that correlation lets you track how much CPU and memory the process is consuming, and lets you terminate the process if necessary. To see all the processes running on the system in Task Manager, click Show processes from all users, and to see the PID column, click View, Select Columns, and select the PID check box.
You can find the logon event and any other event associated with a logon session in the Security event log by correlating the logon session identifier in LogonSessions’ output with the logon ID in the description of the Security log event.