Get the username of a person logged onto a computer remotely using PowerShell and WMI


So recently I was out visiting a customer who had issues with someone hammering their internet.  We enabled netflow on their Cisco router to do a show top-talkers.  Once we got an IP address we were able to find the machine, but not who.  So I quickly entered the following into PowerShell and got the person we were after (change COMPUTERNAME to the target machine name).

Get-WmiObject Win32_ComputerSystem -ComputerName "COMPUTERNAME" |
Select-Object -ExpandProperty UserName

You will need to have admin rights on the target machine for the above to work.

Another way you can do it is to use wmic to achieve the same result, enter the below into a command prompt window, changing COMPUTERNAME to the target machine;

wmic.exe /node:COMPUTERNAME computersystem get username

Hope that helps someone out.


3 responses to “Get the username of a person logged onto a computer remotely using PowerShell and WMI”

  1. John AG Avatar

    Hi John,

    Great post, actually very handy command. I usually use SCCM, but this can be a little time consuming.

    Simple powershell saves so much time.

  2. John AG Avatar

    Hi John,

    Great post, actually very handy command. I usually use SCCM, but this can be a little time consuming.

    Simple powershell saves so much time.

  3. boB Avatar
    boB

    This is the same thing I’m using to determine if a machine $m is available for maintenance:
    $User = (Get-WmiObject -ComputerName $m.Name -Class Win32_ComputerSystem 2>$null) | Select UserName

    But what I’m finding is this shows me the user logged in LOCALLY, it does not show a user using RDP. Any idea how to identify a remote user??

    Thanks!!

Leave a Reply

More Posts

Update WSUS 3.0 SP2 to support Windows 8 and Windows Server 2012 Clients

Just a quick one today.  Microsoft have released an update for those running WSUS 3.0 SP2 which allows you  to provide updates to clients running Windows 8 and Server 2012.  The update is available at this Knowledge Base Article for both 32 and 64 bit environments. Also, no word yet on when they will be releasing […]

How to Reset a Domain Controller’s Domain Admin password for a Virtual Machine running up in Azure

The Reset password utility for Virtual Machines has come in handy on the odd occasion when we never recorded or misplaced the password for a VM running in Azure. The downside is this tool does not support running against Domain Controllers (to reset the in-built Administrator account).  So what happens when you have a domain […]

How to Switch from IDE to AHCI without repairing/reinstalling Windows

A few weeks ago I installed an SSD drive in my home PC. For some reason up until tonight I never checked what the Sata mode was set to in the bios. It was set to IDE. Usually when changing the storage mode in the bios requires a reformat as windows will no longer boot. […]