3

is there a way to check remotely if a user is working at a computer? ("psloggedon" just lets me know a user is logged-on and nothing else)

8

It depends on your definition of 'working on' the computer.

You can use the tasklist /S command to connect to a remote computer and see which processes are running on it, and you can combine this with a filter for a username, if you know which user to check on:

C:\Documents and Settings\adam>tasklist /FI "USERNAME eq NTDOM\joe.bloggs" /S REMOTEPC

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
rdpclip.exe                   5808 RDP-Tcp#2                  2      5,132 K
explorer.exe                   656 RDP-Tcp#2                  2     15,228 K
AClntUsr.EXE                  6804 RDP-Tcp#2                  2      4,252 K
cpqteam.exe                   6244 RDP-Tcp#2                  2      3,608 K
ctfmon.exe                    4300 RDP-Tcp#2                  2      3,448 K
ctfmon.exe                    3780 RDP-Tcp#2                  2      2,764 K
shstat.exe                    6836 RDP-Tcp#2                  2        788 K
cmd.exe                       4168 RDP-Tcp#2                  2      2,352 K
logon.scr                     6360 RDP-Tcp#2                  2      2,572 K

I can see which programs "joe" is running. One of them is logon.scr, so I guess he's not doing much at the moment. However, he has cmd.exe running, so he probably was doing something on there at some point. If it were, say, winword.exe (MS word) or excel.exe (MS Excel) - I'd definitely not want to remotely reboot his computer, even if logon.scr was running. He might not have saved all his work.

If you don't know which user you're looking for, you could maybe use the filter "USERNAME ne SYSTEM". If you're scripting this, you could take the username from the output of wmic ComputerSystem Get UserName.

If you just want to know if users are busy clicking things and pressing keys, you can use quser.exe:

C:\scripts>quser
 USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
>adam.thompson         console             1  Active      none   07/03/2012 11:42

I'm not sure how accurate the IDLE TIME bit is in quser when the session is 'console' and refers to a user physically sat at the computer (as opposed to having used terminal services with a /console switch), though.

Be careful with using things like VNC to determine what's happening on a computer. There's privacy and (depending on where you are) legal concerns around such things.

| improve this answer | |
1

One way would be to set up a VNC server on that machine, remotely log in to it and simply observe screen activity. I use UltraVNC for something similar.

| improve this answer | |
  • 2
    I think the idea is that you can check if someone is using the PC before you connect. It's obvious when someone connects with VNC. – user2924019 Aug 12 '16 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.