Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

is there a way to check remotely if a user is working at a computer? ("psloggedon" just lets me know a user is logged-on and nothing else)

share|improve this question
by "working" you mean that you want to know if the user is loged-in, is moving the mouse, has some (special) program running, is typing in the keyboard, or.... ? – woliveirajr Mar 9 '12 at 14:41
thanks, i will check that solution. – John Mar 9 '12 at 14:50
up vote 4 down vote accepted

It depends on your definition of 'working on' the computer.

You can use the tasklist /S command to connect to a remote computer and see which processes are running on it, and you can combine this with a filter for a username, if you know which user to check on:

C:\Documents and Settings\adam>tasklist /FI "USERNAME eq NTDOM\joe.bloggs" /S REMOTEPC

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
rdpclip.exe                   5808 RDP-Tcp#2                  2      5,132 K
explorer.exe                   656 RDP-Tcp#2                  2     15,228 K
AClntUsr.EXE                  6804 RDP-Tcp#2                  2      4,252 K
cpqteam.exe                   6244 RDP-Tcp#2                  2      3,608 K
ctfmon.exe                    4300 RDP-Tcp#2                  2      3,448 K
ctfmon.exe                    3780 RDP-Tcp#2                  2      2,764 K
shstat.exe                    6836 RDP-Tcp#2                  2        788 K
cmd.exe                       4168 RDP-Tcp#2                  2      2,352 K
logon.scr                     6360 RDP-Tcp#2                  2      2,572 K

I can see which programs "joe" is running. One of them is logon.scr, so I guess he's not doing much at the moment. However, he has cmd.exe running, so he probably was doing something on there at some point. If it were, say, winword.exe (MS word) or excel.exe (MS Excel) - I'd definitely not want to remotely reboot his computer, even if logon.scr was running. He might not have saved all his work.

If you don't know which user you're looking for, you could maybe use the filter "USERNAME ne SYSTEM". If you're scripting this, you could take the username from the output of wmic ComputerSystem Get UserName.

If you just want to know if users are busy clicking things and pressing keys, you can use quser.exe:

>adam.thompson         console             1  Active      none   07/03/2012 11:42

I'm not sure how accurate the IDLE TIME bit is in quser when the session is 'console' and refers to a user physically sat at the computer (as opposed to having used terminal services with a /console switch), though.

Be careful with using things like VNC to determine what's happening on a computer. There's privacy and (depending on where you are) legal concerns around such things.

share|improve this answer

One way would be to set up a VNC server on that machine, remotely log in to it and simply observe screen activity. I use UltraVNC for something similar.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .