JSI Tip 8433. Another way to determine who is currently logged on to your domain.JSI Tip 8433. Another way to determine who is currently logged on to your domain.

When I was asked if there was a way to determine who was logged on to a domain, without inspecting the Security event logs for audited log on and log off events, I had forgotten that I had scripted WhoDom.bat.

Using the NET VIEW command, and Psloggedon freeware, I scripted a new WhoDom.bat to return the computer name, log on date / time, and user name of all users currently logged on to the same domain as the user running WhoDom.bat from their workstation.

WhoDom.bat requires no parameters.

WhoDom.bat contains:

@echo offsetlocal ENABLEDELAYEDEXPANSIONset dom=%USERDOMAIN%for /f "Tokens=1" %%c in ('net view /domain:%dom%^|findstr /L /C:"\"') do ( for /f "tokens=*" %%u in ('psloggedon -L %%c^|findstr /L /C:"/"') do (  set work1=%%u  call set work2=!!work1:%dom%=!!  if "!work2!" NEQ "!work1!" @echo %%c %%u  ))endlocal

Sample output:

\JSI001 08/18/2004 18:46:39    JSIINCAlisa\JSI005 08/21/2004 06:23:16    JSIINCRichard\JSI007 08/28/2004 18:51:36    JSIINCJennifer\JSI009 08/28/2004 18:52:03    JSIINCJerry