How to Show Logged-In Users with PowerShell

Recently, I got a requirement to show logged-in users. In this tutorial, I will explain how to show logged-in users with PowerShell. For each method, I will provide you with some real-world examples.

Note: You need to have administrative privileges on the machine, and you should have PowerShell 5.1 or later installed.

Now, let me show you different methods.

Table of Contents

Method 1: Using the query user

The query user command is a simple and effective way to see who is logged into a machine. This command is built into Windows and does not require any additional modules.

Example

Here is an example:

Open PowerShell with administrative privileges and run the following command:

query user

You will see an output similar to this:

 USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
>fewli                 console             1  Active      none   31-03-2025 11:39

This output shows the usernames, session names, session IDs, states, idle times, and logon times of all users currently logged in.

I executed the above PowerShell script, and you can see the exact output in the screenshot below:

Check out Remove a Computer from a Domain Using PowerShell

Method 2: Using Get-WmiObject

The Get-WmiObject cmdlet allows you to query Windows Management Instrumentation (WMI) for information about the system, including logged-in users.

Example

To get the currently logged-in users, run the following command:

Get-WmiObject -Class Win32_ComputerSystem | Select-Object -ExpandProperty UserName

This command will return the username of the user currently logged into the console session. If multiple users are logged in via Remote Desktop, this method will not show all users.

Bijay\fewli

You can see the exact output in the screenshot below:

Check out Add a Computer to a Domain Using PowerShell

Method 3: Using Get-Process

Another method to find logged-in users is by checking the processes running on the system. This can be particularly useful for identifying users logged in via Remote Desktop.

Example

Run the following command to list the users associated with each process:

Get-Process | Where-Object { $_.ProcessName -eq 'explorer' } | Select-Object -ExpandProperty StartInfo | Select-Object -ExpandProperty UserName

This command filters processes to find instances of explorer.exe and then retrieves the associated usernames. This is useful because each user session typically has an instance of explorer.exe running.

Check out Set the Default Printer Using PowerShell in Windows

Method 4: Using quser

The quser command is similar to query user but provides additional details about each session.

Example

Run the following command:

quser

You will see an output similar to this:

 USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
>fewli                 console             1  Active      none   31-03-2025 11:39

This output includes the same information as query user but may also show additional details depending on the system configuration.

Here is the output in the screenshot below:

How to Show Logged-In Users with PowerShell

Check out Set Password Never Expires for Local User Using PowerShell

Method 5: Using Get-LoggedOnUser

For a more detailed and customizable approach, you can use a PowerShell script. The following script uses WMI to get information about logged-in users and their sessions.

Example Script

function Get-LoggedOnUser {
    param (
        [string]$ComputerName = $env:COMPUTERNAME
    )

    $sessions = Get-WmiObject -Class Win32_LogonSession -ComputerName $ComputerName
    $userSessions = @()

    foreach ($session in $sessions) {
        $assoc = Get-WmiObject -Query "Associators of {Win32_LogonSession.LogonId=$($session.LogonId)} Where AssocClass=Win32_LoggedOnUser" -ComputerName $ComputerName
        foreach ($user in $assoc) {
            $userSessions += [PSCustomObject]@{
                UserName   = $user.Antecedent.Name
                Domain     = $user.Antecedent.Domain
                LogonId    = $session.LogonId
                LogonType  = $session.LogonType
                StartTime  = $session.StartTime
            }
        }
    }

    return $userSessions
}

Get-LoggedOnUser

This script retrieves detailed information about each logged-in user, including the username, domain, logon ID, logon type, and logon start time.

Conclusion

In this tutorial, I have explained several methods to show logged-in users using PowerShell, such as using built-in commands like query user and quser, or more advanced techniques with Get-WmiObject and custom scripts, etc.

Do let me know if you still have any questions in the comments below.

Method 1: Using the query user

Example

Method 2: Using Get-WmiObject

Example

Method 3: Using Get-Process

Example

Method 4: Using quser

Example

Method 5: Using Get-LoggedOnUser

Example Script

Conclusion

100 POWERSHELL CMDLETS E-BOOK