We have 1 user account that everyone uses to log in remotely to one machine [Windows Server 2003 box]. For example, the machine everyone needs to remote into is called ABC. Someone on another machine called XYZ does a remote desktop session to ABC. From my machine, MNOP, I want to see what machine is remoting into ABC. This way if I or someone else needs to remote into ABC we don't have to send an email to everyone in the office to see who is remoting in. Let me be clear, because of how they setup the servers way back, we have to all use the same username to remote in. So it's not possible for us to log in using our own usernames.


1 Answer 1


The Sysinternals utilities will help you in this task. Sysinternals was originally an independent company created by Mark Russinovich and Bryce Cogswell, bought several years ago by Microsoft which also acquired Russinovich (the guy who discovered that Sony planted ill-designed rootkits on its records as a form of DRM) to VP for Technical Development (or some such thing, don't remember off the top of my head).

These utilities can be found at this Web site. You may find these two utilities most helpful:

1) PSLogged On:

You can determine who is using resources on your local computer with the "net" command ("net session"), however, there is no built-in way to determine who is using the resources of a remote computer. In addition, NT comes with no tools to see who is logged onto a computer, either locally or remotely. PsLoggedOn is an applet that displays both the locally logged on users and users logged on via resources for either the local computer, or a remote one. If you specify a user name instead of a computer, PsLoggedOn searches the computers in the network neighborhood and tells you if the user is currently logged on.

2) TCPView:

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. On Windows Server 2008, Vista, and XP, TCPView also reports the name of the process that owns the endpoint. TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows. The TCPView download includes Tcpvcon, a command-line version with the same functionality.

3) LogonSessions

If you think that when you logon to a system there's only one active logon session, this utility will surprise you. It lists the currently active logon sessions and, if you specify the -p option, the processes running in each session.

By piecing together information from these three commands (it would have been much simpler, of course, if you had given each user his own username) you can achieve what you wish.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .