I looked around for this issue and have found two approaches: use a database table to log users logging in and remove the entry when they log out or session ends; or use Membership.GetNumberOfUsersOnline(). I tried Membership version first but when I log in it shows the number to be zero (I am using form-based authentication, using AD in in Intranet web application and using Oracle DB).
I also created a table having user's ID (what is stored as aspnet_user's username), their aspnet_user's userid, login time stamp and logout time stamp. When user logs in, I add an entry and when users logs out, I remove the entry. The problem here is if session ends and Session_End() event is called I have no way of accessing user's ID (stored in session var) in order to remove the correct entry from table.