# Seeing Windows network users **URL:** \ **Category:** Factual Questions\ **Created:** [January 19, 2023, 4:21pm UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462 "2023-01-19T16:21:39Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [January 19, 2023, 4:21pm UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/1 "2023-01-19T16:21:39Z")
Where on a Windows server, can you see users and the devices they are logged into? ---
**Author:** ![FinsToTheLeft](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/finstotheleft/32/2930_2.png) [@FinsToTheLeft](https://boards.straightdope.com/u/FinsToTheLeft)\ **Post date:** [January 19, 2023, 5:23pm UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/2 "2023-01-19T17:23:26Z")
Not quite sure what you mean here. Are we talking Remote Desktop sessions, or just using a file share, or something else? ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [January 19, 2023, 5:42pm UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/3 "2023-01-19T17:42:07Z")
Users are logged into network computers. There is a Windows server. Using the server, how can we tell: Which devices is user plant logged into? Which PCs is user Sally logged into? ---
**Author:** ![FinsToTheLeft](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/finstotheleft/32/2930_2.png) [@FinsToTheLeft](https://boards.straightdope.com/u/FinsToTheLeft)\ **Post date:** [January 19, 2023, 6:00pm UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/4 "2023-01-19T18:00:59Z")
Assuming you are using Active Directory and not a workgroup, you can [enable audit event logging with group policy](https://learn.microsoft.com/en-us/troubleshoot/windows-client/user-profiles-and-logon/track-users-logon-logoff) and then look at login events in Event Viewer. You wouldn’t be able to see if they are still logged in and just walked away as there is no logout event unless they explicitly log off. There are third party tools that do a better job like [https://www.netwrix.com/](https://www.netwrix.com/). ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [January 19, 2023, 6:03pm UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/5 "2023-01-19T18:03:44Z")
I’ve seen a list of which devices are currently on the network and which users are logged onto them. Like: Cecil-Cecil’s PC Cecil-Cecil’s Iphone Bill-Computer12 Sally-Computer 25 etc. ---
**Author:** ![FinsToTheLeft](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/finstotheleft/32/2930_2.png) [@FinsToTheLeft](https://boards.straightdope.com/u/FinsToTheLeft)\ **Post date:** [January 19, 2023, 6:24pm UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/6 "2023-01-19T18:24:43Z")
Are you looking for a way to do this or are you trying to figure out if the admin can see where/if you are logged in? There are commands like NET SESSION, but that will only show user accessing a file share on a given computer. There is no single out-of-the box console built into Windows where I can see logged in users to different computers on a domain. To add to that, your example of seeing who is logged into an iPhone makes no sense. iPhones are not user context devices and have nothing to do with Windows, other than possibly being assigned an IP address via DHCP or using RADIUS authentication for WPA2 Enterprise wifi. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [January 19, 2023, 8:08pm UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/7 "2023-01-19T20:08:16Z")
Sally logged into her desk computer. Sally logged into someone’s PC to check her email when she was away from her desk. A week later, Sally changed her password. Someone’s PC tries talks to the server with the wrong password. Sally’s account is locked. I unlock her account. Rinse and repeat. I have seen some sever display that shows devices on the network and who is logged into them. I want to find the PC sally forgot she logged into a week ago and log her off. Thanks. ---
**Author:** ![FinsToTheLeft](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/finstotheleft/32/2930_2.png) [@FinsToTheLeft](https://boards.straightdope.com/u/FinsToTheLeft)\ **Post date:** [January 20, 2023, 1:21am UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/8 "2023-01-20T01:21:50Z")
Tracking down lockouts is a pain in the butt. Enable auditing on domain controllers and then check the event log for login failure. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [January 20, 2023, 2:17am UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/9 "2023-01-20T02:17:51Z")
How do we do that? I am a Novell admin guy. ---
**Author:** ![FinsToTheLeft](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/finstotheleft/32/2930_2.png) [@FinsToTheLeft](https://boards.straightdope.com/u/FinsToTheLeft)\ **Post date:** [January 20, 2023, 2:30am UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/10 "2023-01-20T02:30:59Z")
Haven’t touched Novell since the mid-90s. Take a look at [Account Lockout Event ID: Find the Source of Account Lockouts](https://activedirectorypro.com/account-lockout-event-id/) ---
**Author:** ![WhyKickAMooCow](https://avatars.discourse-cdn.com/v4/letter/w/9fc29f/32.png) [@WhyKickAMooCow](https://boards.straightdope.com/u/WhyKickAMooCow)\ **Post date:** [January 20, 2023, 11:18am UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/11 "2023-01-20T11:18:03Z")
I’ve used this tool before (paid but it’s cheap). It scans the network using a variety of means and shows devices and logons. > **[SoftPerfect Network Scanner : fast, flexible, advanced](https://www.softperfect.com/products/networkscanner/)** > > Fast multi-threaded IPv4/IPv6 scanner with an extensive range of options and advanced features for system administrators and general users. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [January 20, 2023, 8:34pm UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/12 "2023-01-20T20:34:23Z")
Thanks! ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [January 20, 2023, 8:35pm UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/13 "2023-01-20T20:35:42Z")
Sally had another PC in another room for testing. I thought she had already logged on with the new password, but users exaggerate or do not understand. She is now logged onto the second PC, and her account remains unlocked. Thanks again, everyone. ---
**Author:** ![Steven\_G](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steven_g/32/5080_2.png) [@Steven\_G](https://boards.straightdope.com/u/Steven_G)\ **Post date:** [January 22, 2023, 11:02pm UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/14 "2023-01-22T23:02:47Z")
Just saw this thread. I realise it’s solved, but would the command “net session” executed on the server not have been the easy way? ---
**Author:** ![FinsToTheLeft](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/finstotheleft/32/2930_2.png) [@FinsToTheLeft](https://boards.straightdope.com/u/FinsToTheLeft)\ **Post date:** [January 23, 2023, 2:00am UTC](https://boards.straightdope.com/t/seeing-windows-network-users/978462/15 "2023-01-23T02:00:29Z")
> [@Steven\_G](#): > > I realise it’s solved, but would the command “net session” executed on the server not have been the easy way? I mentioned it in post 5, but the problem is the password had been changed and the user was getting locked due to password failure, so there wouldn’t be an active session.