How to Find Logged In User Using PowerShell?

One of my team members recently asked me for a PowerShell script to get the logged-in user name. In this tutorial, I will explain how to find the logged-in user on a Windows machine using PowerShell.

Note: You need to have administrator privileges to execute the commands.

Table of Contents

Find Logged In User using PowerShell

Now, let me show you different ways to find the logged-in user in PowerShell.

1. Using Get-WmiObject

The best way to find the currently logged-in user in PowerShell is by using the Get-WmiObject cmdlet. This cmdlet allows you to query Windows Management Instrumentation (WMI) for various system information.

Let me show you an example.

$user = Get-WmiObject -Class Win32_ComputerSystem | Select-Object -ExpandProperty UserName
Write-Output "The currently logged-in user is: $user"

This command queries the Win32_ComputerSystem class and retrieves the UserName property, which contains the name of the currently logged-in user. For instance, if John Doe is logged in on a machine named Bijay\fewli, the output will be:

The currently logged-in user is: Bijay\fewli

I executed the above PowerShell script, and you can see the output in the screenshot below.

Check out Find Installed Software Using PowerShell

2. Using Query User Command

The query user command is a built-in Windows utility that can be executed within PowerShell to list all users currently logged into a remote or local machine.

Here is an example.

$queryResults = query user
Write-Output "Logged in users:"
$queryResults

This command provides a list of all users logged into the system, including session IDs, session states, and idle times. This is particularly useful for administrators managing terminal servers or remote desktop sessions.

You can see the exact output in the screenshot below:

How to Find Logged In User using PowerShell

Read How to Enable Remote Desktop Using PowerShell?

3. Using Get-Process Cmdlet

Let me show you another way to get the logged user name from the system using PowerShell.

It involves using the Get-Process cmdlet to identify users running specific processes. This can be helpful if you need to find users based on their activity.

Here is an example of using the Get-Process cmdlet.

$processes = Get-Process -IncludeUserName | Where-Object { $_.UserName -ne $null }
foreach ($process in $processes) {
    Write-Output "User: $($process.UserName) is running process: $($process.Name)"
}

This script retrieves all processes along with their associated user names and filters out those without a user name. It then outputs the user names and the processes they are running.

Check out How to Uninstall a Program with PowerShell?

Find Logged In Users on Remote Machines using PowerShell

Now, let me show you how to find logged-in users on remote machines using PowerShell. This will be helpful if you are working as an administrator.

Using Invoke-Command

The Invoke-Command cmdlet allows you to run commands on remote computers.

Here is an example.

$remoteComputer = "REMOTE-PC"
$scriptBlock = { Get-WmiObject -Class Win32_ComputerSystem | Select-Object -ExpandProperty UserName }
$remoteUser = Invoke-Command -ComputerName $remoteComputer -ScriptBlock $scriptBlock
Write-Output "The currently logged-in user on $remoteComputer is: $remoteUser"

This script block runs the same Get-WmiObject command on a remote computer specified by $remoteComputer and retrieves the logged-in user.

Read How to Uninstall Microsoft Edge Using PowerShell?

Using Get-WmiObject for Remote Queries

The Get-WmiObject cmdlet can also be used directly to query remote machines. Let me show you an example.

$remoteComputer = "REMOTE-PC"
$remoteUser = Get-WmiObject -Class Win32_ComputerSystem -ComputerName $remoteComputer | Select-Object -ExpandProperty UserName
Write-Output "The currently logged-in user on $remoteComputer is: $remoteUser"

This command connects to the remote computer and retrieves the logged-in user in a similar manner to the local query.

Read How to Set Proxy in PowerShell?

Automate The Script

Sometimes, you might want to automate the generating reports on logged-in users. You can also schedule the script to run at regular intervals using Task Scheduler.

Here is the complete PowerShell script:

$computers = @("PC1", "PC2", "PC3")
$report = @()

foreach ($computer in $computers) {
    $user = Get-WmiObject -Class Win32_ComputerSystem -ComputerName $computer | Select-Object -ExpandProperty UserName
    $report += [PSCustomObject]@{
        ComputerName = $computer
        LoggedInUser = $user
    }
}

$report | Export-Csv -Path "C:\Reports\UserLoginReport.csv" -NoTypeInformation

This PowerShell script retrieves the currently logged-in user for each computer specified in the $computers array, creates a custom object with the computer name and user name, and then exports the results to a CSV file named “UserLoginReport.csv” in the “C:\Reports” directory.

To schedule this, you can follow the below steps:

Save the script with name as UserLoginReport.ps1
Open Task Scheduler.
Create a new task.
Set the trigger to your desired schedule.
Set the action to “Start a Program” and specify powershell.exe with arguments -File "C:\Path\To\UserLoginReport.ps1".

Read How to Uninstall Firefox Using PowerShell?

Troubleshooting Issues

You might encounter some common issues while using PowerShell to find logged-in users. Here are a few tips to troubleshoot them:

Permission Issues

Ensure you have the necessary administrative privileges to execute commands on local and remote machines. Running PowerShell as an administrator can resolve most permission-related problems.

Network Connectivity

Verify network connectivity between your machine and the target computers for remote queries. Firewalls and network policies might block remote PowerShell sessions.

WMI Service

Ensure the Windows Management Instrumentation (WMI) service runs on local and remote machines. Restarting the WMI service can resolve issues related to WMI queries.

Conclusion

In this tutorial, I explained how to find the logged-in users using PowerShell using different methods. I have also shown how to find logged-in users on remote machines using PowerShell.