How to Find Who is Logged on to a Computer in a Batch Script

Knowing which users are currently logged on to a local or remote computer is a fundamental task for system administrators. You might need to check if a user is active before performing remote maintenance, generate a report of all active sessions on a server, or simply identify the current interactive user for a script.

This guide will teach you the two primary built-in commands for this task. We'll cover the modern and simple quser (Query User) command, which is the recommended method, as well as the classic qwinsta (Query Windows Station) command. You will learn how to target a remote computer and how to parse the output to get just the usernames.

Method 1 (Recommended): The quser Command

The quser.exe utility is the standard and most direct tool for querying user logon sessions. It provides a clean, human-readable table of all active and disconnected sessions on a system.

Command: quser

The output includes the username, the session name, a session ID, its current state, and more.

 USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
>adminuser             console             1  Active      none   10/27/2023 9:00 AM

Method 2 (Alternative): The qwinsta Command

The qwinsta.exe (Query Windows Station) utility provides similar information but in a slightly different format. It is part of the same family of tools as quser and is often used for remote desktop session management.

Command: qwinsta

The output is very similar to quser, just with slightly different column headers.

 SESSIONNAME       USERNAME                 ID  STATE   TYPE        DEVICE
 services                                    0  Disc
>console           adminuser                 1  Active
 rdp-tcp                                 65536  Listen

How to Query a Remote Computer

Both quser and qwinsta can be used to query a different computer on your network. You simply add the /SERVER switch followed by the computer's name.

Syntax:

• quser /SERVER:RemoteComputerName
• qwinsta /SERVER:RemoteComputerName

Example of script:

@ECHO OFF
SET "TargetServer=SERVER-01"
ECHO --- Checking for logged on users on %TargetServer% ---
ECHO.
quser /SERVER:%TargetServer%

Parsing the Output to Get Just Usernames

To use this information in a script, you need to extract just the usernames from the output. A FOR /F loop is perfect for this.

This script uses quser and parses its output to get a clean list of just the logged-on usernames.

@ECHO OFF
ECHO --- Currently Logged-On Users ---
ECHO.

REM 'skip=1' ignores the header line.
REM 'tokens=1' grabs the first "word" on each line, which is the username.
FOR /F "skip=1 tokens=1" %%U IN ('quser') DO (
    ECHO User: %%U
)

Output:

--- Currently Logged-On Users ---

User: >adminuser

Common Pitfalls and How to Solve Them

• Permissions for Remote Queries: The most common failure is an "Access is denied" error when querying a remote server. Solution: You must be running the script as a user who is an administrator on the target machine. Ensure that the necessary firewall rules (for Remote Administration) are enabled on the target as well.

• Parsing Disconnected Sessions: Both quser and qwinsta will list users who are connected but currently "Disconnected" from their Remote Desktop session. The "STATE" column shows this. You can filter these out with FINDSTR.

  REM This shows only Active sessions.
  quser | FINDSTR /I "Active"

• No Users Logged On: If no interactive users are logged on (only system services), the quser command will report "No User exists for *". Your parsing script should be able to handle this empty state. The FOR /F loop will simply not run, which is a safe default behavior.

Practical Example: A Logon Audit Script

This script queries a list of servers and creates a report of which users are logged on to each one. This is a common task for a daily system audit.

@ECHO OFF
SETLOCAL
SET "ServerList=SERVER-01 FILESERVER-02 WEB-SERVER"
SET "ReportFile=Logon_Audit_Report.txt"

ECHO --- Generating Logon Audit Report ---
ECHO Report will be saved to: %ReportFile%
ECHO.

(
    ECHO Logon Audit Report
    ECHO Generated on %DATE% at %TIME%
    ECHO =======================================
) > "%ReportFile%"

FOR %%S IN (%ServerList%) DO (
    (
        ECHO.
        ECHO --- Users on %%S ---
    ) >> "%ReportFile%"
    
    REM Append the output of quser for the remote server to the report.
    quser /SERVER:%%S >> "%ReportFile%" 2>NUL
    
    REM Check if the command failed (e.g., server offline).
    IF %ERRORLEVEL% NEQ 0 (
        ECHO   -> Could not contact server %%S.
    ) >> "%ReportFile%"
)

ECHO.
ECHO --- Report Complete ---
ENDLOCAL

Conclusion

The quser and qwinsta commands are the standard, built-in tools for identifying logged-on users in Windows.

• quser is the recommended command for its clean and direct output.
• Use the /SERVER:ComputerName switch to query a remote machine.
• You can easily parse the output with a FOR /F "skip=1 tokens=1" loop to get a list of usernames for use in your automation.
• Remember that you must have administrative privileges on a remote machine to query it successfully.