This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(57.599999999999994, 96%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENA%3C/text%3E%3C/svg%3E)
Hi, I need to check which user is connected to which computer according to Active Directory,
I found the command Get-LoggedOnUser but I can not get all the data I need for all the computers in the organization, does anyone know a script that can get it out for me quickly?
Thank you,
Noam
but I can not get all the data I need
What data are you looking for?
A quick internet search shows a number of posts with sample scripts. Get-LoggedOnUser is not a Powershell 5.1 cmdlet, it's a user developed script and there appears to be multiple scripts with that name.. Which one are you using? What doesn't work?
Hi, I need to get a table from AD
With the name of the user, the computer you recently connected to, and the last connection date to the computer
This looks like it would be a good starting point.
http://woshub.com/check-user-logon-history-active-directory-domain-powershell/
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 74%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERM%3C/text%3E%3C/svg%3E)
For an organization of lots of user/computers the security logs on the DCs are going to grow pretty rapidly once you begin auditing logon/logoff events. Don't fail to take this into account or you may wind up with DCs either overwriting the security log or just stop working until you intercede to add more log space or purge the log (thereby screwing up your reporting).
If you have several (or many) DC, be sure the time on those machines is synchronized more often than the default intervals. Not all clocks run at the same speed. IIRC, Windows allows up to a five minute difference between the time from machine-to-machine.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 31%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETD%3C/text%3E%3C/svg%3E)
I had the same problem but found a somewhat awkward solution. Instead of querying the users directly, I first check for sessions. Then I check whether there uis a session whose sessionname begins with "rdp-tcp#' or is simply empty.
If so, it means that there is at least one loggedon user. After that I query for all users on the same server. If there is no such hit, I simply return a differnt value.
