-3

I am a user in a domain where there are lot of cloud machines available.Now the problem is these machines can be logged in by any people .Though I can restart these machines using the command shutdown /r /f /t 0 -m .Before doing so I want to know who was the user logged in to that machine.Is there any command for that?

Srikant Barik
  • 1

1 Answers1

1

Check event logs, they're different based upon OS version. Use PowerShell and WMI to find who's currently logged on and at what time:

Get-WmiObject -Class Win32_UserProfile | Select-Object -Property SID,LocalPath,Loaded,LastUseTime,@{Name=”Account”;Expression={((New-Object -TypeName System.Security.Principal.SecurityIdentifier($_.SID)).Translate([System.Security.Principal.NTAccount])).Value}}

This blog has all kinds of ways to look at who's logged onto the system:
Determining the Dominant User and Setting the ManagedBy Computer Attribute

spacenomyous
  • 1,319
  • 7
  • 15