How to Get a List of Users Currently Logged into a Remote Computer in Batch Script
Determining who is currently logged into a remote computer is a frequent requirement in IT support and systems administration. You might need to know if a machine is in use before dispatching a reboot command or checking if specific users have active sessions on a terminal server.
In this guide, we will explore the best methods for retrieving the list of currently logged-in users on a remote machine using Batch scripts. We will look at both the query session command and the older WMI method.
Method 1: Using query session (Recommended)
The most robust and standard tool for checking active sessions, including Remote Desktop (RDP) and console sessions, is the query session (or qwinsta) command.
Basic Syntax
query session /server:RemoteComputerName
Or using its alias:
qwinsta /server:RemoteComputerName
Example Usage and Output
If you target a remote server named FileServer01:
qwinsta /server:FileServer01
Typical Output:
SESSIONNAME USERNAME ID STATE TYPE DEVICE
services 0 Disc
console 1 Conn
rdp-tcp#0 Administrator 2 Active
rdp-tcp#1 JSmith 3 Active
rdp-tcp 65536 Listen
This output gives you everything you need: to see that Administrator and JSmith are actively logged in via RDP.
Scripting the Output
While qwinsta provides the information, raw console output isn't always script-friendly. Usually, you only want the list of active user names, stripping away the blank lines, "services" sessions, and headers.
We can use a FOR loop and findstr to filter for active users.
@echo off
setlocal EnableDelayedExpansion
set "TARGET_PC=FileServer01"
echo Checking logged in users on \\%TARGET_PC%...
echo --------------------------------------------
REM Verify the computer is online first
ping -n 1 -w 1000 %TARGET_PC% >nul 2>nul
if %ERRORLEVEL% neq 0 (
echo [!] %TARGET_PC% is offline or unreachable.
echo --------------------------------------------
echo Done.
pause
exit /b
)
REM Run qwinsta and filter the output
REM qwinsta columns: SESSIONNAME USERNAME ID STATE
REM When SESSIONNAME is present, USERNAME is token 2 and ID is token 3.
REM When SESSIONNAME is blank, columns shift left: token 2 becomes ID.
REM We use numeric detection to identify which token is the ID vs. a username.
set "UsersFound=0"
for /f "skip=1 tokens=1-4" %%A in ('qwinsta /server:%TARGET_PC% 2^>nul') do (
REM Check if token C (expected ID position) is numeric
echo %%C | findstr /r "^[0-9][0-9]*$" >nul 2>&1
if !ERRORLEVEL! equ 0 (
REM Normal layout: %%A=SESSIONNAME, %%B=USERNAME, %%C=ID, %%D=STATE
REM Only report if there is actually a username and the state is Active or Disc
if not "%%B"=="" (
echo %%D | findstr /i "Active Disc" >nul 2>&1
if !ERRORLEVEL! equ 0 (
echo User Found: %%B ^(Session ID: %%C, Status: %%D^)
set "UsersFound=1"
)
)
) else (
REM Shifted layout: %%A=USERNAME, %%B=ID, %%C=STATE (no SESSIONNAME)
echo %%B | findstr /r "^[0-9][0-9]*$" >nul 2>&1
if !ERRORLEVEL! equ 0 (
echo %%C | findstr /i "Active Disc" >nul 2>&1
if !ERRORLEVEL! equ 0 (
echo User Found: %%A ^(Session ID: %%B, Status: %%C^)
set "UsersFound=1"
)
)
)
)
if "!UsersFound!"=="0" (
echo No active users found or access was denied.
)
echo --------------------------------------------
echo Done.
pause
Parsing qwinsta precisely with pure Batch is notoriously difficult because its output table is space-aligned, not tab-delimited. Therefore, columns shift if a user has a long name or if a session name is missing. The script above handles common scenarios but relies on heuristic checks. For guaranteed bulletproof parsing of remote sessions, PowerShell's Get-RDUserSession module is significantly more robust.
Method 2: Using WMI via wmic
Another method involves querying the Windows Management Instrumentation (WMI) specifically targeting the Win32_ComputerSystem class, which holds the currently logged-on console user.
WMI Syntax
wmic /node:"RemoteComputerName" computersystem get username
Output:
UserName
DOMAIN\JSmith
Why Use wmic?
The wmic approach is excellent when you only care about the physical console session (e.g., assessing who is sitting at a physical workstation). It clearly outputs the domain and username.
Limitations of wmic
- Console Only: WMI's
Win32_ComputerSystemonly returns the user physically logged into the console at that exact moment. It does not list users connected via Remote Desktop (RDP). - Returns Null on Lock: If the computer is locked or at the login screen, it will often return nothing or an error.
- Speed: WMI queries are generally slower than
qwinsta.
A Simple WMI Script
@echo off
setlocal EnableDelayedExpansion
set /p "TARGET_PC=Enter workstation name: "
if "!TARGET_PC!"=="" (
echo No computer name entered. Exiting.
pause
exit /b
)
echo Querying console user for !TARGET_PC!...
set "LOGGED_USER="
for /f "skip=1 delims=" %%U in ('wmic /node:"!TARGET_PC!" computersystem get username 2^>nul') do (
REM wmic output includes trailing carriage returns; use a nested for to trim
for /f "tokens=*" %%A in ("%%U") do (
if not "%%A"=="" set "LOGGED_USER=%%A"
)
)
if not defined LOGGED_USER (
echo No user logged in at the console, or machine is locked/offline.
) else (
echo Currently logged-in Console User: !LOGGED_USER!
)
endlocal
pause
Dealing with Access Denied Errors
For both qwinsta /server: and wmic /node:, the script must be executed by an account with administrative permissions on the target computer. If you target a workstation as a standard user, you will receive an Access is denied or Error 5 message. Always ensure you are running the script prompt "As Administrator" using an authorized account.
Conclusion
To find out who is logged onto a remote Windows computer via Batch script:
- Use
qwinsta /server:ComputerNamewhen you need a comprehensive list of all sessions, particularly on servers where users connect via RDP. - Use
wmic /node:"ComputerName" computersystem get usernamewhen you need a quick query strictly for the user physically sitting at the console (workstations), accepting its limitations regarding locked screens.