How to Get a List of Users Currently Logged into a Remote Computer in Batch Script

Learn how to retrieve active users on a remote Windows machine using Batch scripting with query session (qwinsta) for RDP sessions or WMI for console users.

Determining who is currently logged into a remote computer is a frequent requirement in IT support and systems administration. You might need to know if a machine is in use before dispatching a reboot command or checking if specific users have active sessions on a terminal server.

In this guide, we will explore the best methods for retrieving the list of currently logged-in users on a remote machine using Batch scripts. We will look at both the query session command and the older WMI method.

Method 1: Using `query session` (Recommended)

The most robust and standard tool for checking active sessions, including Remote Desktop (RDP) and console sessions, is the query session (or qwinsta) command.

Basic Syntax

query session /server:RemoteComputerName

Or using its alias:

qwinsta /server:RemoteComputerName

Example Usage and Output

If you target a remote server named FileServer01:

qwinsta /server:FileServer01

Typical Output:

 SESSIONNAME       USERNAME                 ID  STATE   TYPE        DEVICE
 services                                    0  Disc
 console                                     1  Conn
 rdp-tcp#0         Administrator             2  Active
 rdp-tcp#1         JSmith                    3  Active
 rdp-tcp                                 65536  Listen

This output gives you everything you need: to see that Administrator and JSmith are actively logged in via RDP.

Scripting the Output

While qwinsta provides the information, raw console output isn't always script-friendly. Usually, you only want the list of active user names, stripping away the blank lines, "services" sessions, and headers.

We can use a FOR loop and findstr to filter for active users.

@echo off
setlocal EnableDelayedExpansion

set "TARGET_PC=FileServer01"

echo Checking logged in users on \\%TARGET_PC%...
echo --------------------------------------------

REM Verify the computer is online first
ping -n 1 -w 1000 %TARGET_PC% >nul 2>nul
if %ERRORLEVEL% neq 0 (
    echo [!] %TARGET_PC% is offline or unreachable.
    echo --------------------------------------------
    echo Done.
    pause
    exit /b
)

REM Run qwinsta and filter the output
REM qwinsta columns: SESSIONNAME  USERNAME  ID  STATE
REM When SESSIONNAME is present, USERNAME is token 2 and ID is token 3.
REM When SESSIONNAME is blank, columns shift left: token 2 becomes ID.
REM We use numeric detection to identify which token is the ID vs. a username.

set "UsersFound=0"

for /f "skip=1 tokens=1-4" %%A in ('qwinsta /server:%TARGET_PC% 2^>nul') do (
    REM Check if token C (expected ID position) is numeric
    echo %%C | findstr /r "^[0-9][0-9]*$" >nul 2>&1
    if !ERRORLEVEL! equ 0 (
        REM Normal layout: %%A=SESSIONNAME, %%B=USERNAME, %%C=ID, %%D=STATE
        REM Only report if there is actually a username and the state is Active or Disc
        if not "%%B"=="" (
            echo %%D | findstr /i "Active Disc" >nul 2>&1
            if !ERRORLEVEL! equ 0 (
                echo User Found: %%B ^(Session ID: %%C, Status: %%D^)
                set "UsersFound=1"
            )
        )
    ) else (
        REM Shifted layout: %%A=USERNAME, %%B=ID, %%C=STATE (no SESSIONNAME)
        echo %%B | findstr /r "^[0-9][0-9]*$" >nul 2>&1
        if !ERRORLEVEL! equ 0 (
            echo %%C | findstr /i "Active Disc" >nul 2>&1
            if !ERRORLEVEL! equ 0 (
                echo User Found: %%A ^(Session ID: %%B, Status: %%C^)
                set "UsersFound=1"
            )
        )
    )
)

if "!UsersFound!"=="0" (
    echo No active users found or access was denied.
)

echo --------------------------------------------
echo Done.
pause

Method 2: Using WMI via `wmic`

Another method involves querying the Windows Management Instrumentation (WMI) specifically targeting the Win32_ComputerSystem class, which holds the currently logged-on console user.

WMI Syntax

wmic /node:"RemoteComputerName" computersystem get username

Output:

UserName
DOMAIN\JSmith

Why Use `wmic`?

The wmic approach is excellent when you only care about the physical console session (e.g., assessing who is sitting at a physical workstation). It clearly outputs the domain and username.

Limitations of `wmic`

Console Only: WMI's Win32_ComputerSystem only returns the user physically logged into the console at that exact moment. It does not list users connected via Remote Desktop (RDP).
Returns Null on Lock: If the computer is locked or at the login screen, it will often return nothing or an error.
Speed: WMI queries are generally slower than qwinsta.

A Simple WMI Script

@echo off
setlocal EnableDelayedExpansion

set /p "TARGET_PC=Enter workstation name: "

if "!TARGET_PC!"=="" (
    echo No computer name entered. Exiting.
    pause
    exit /b
)

echo Querying console user for !TARGET_PC!...

set "LOGGED_USER="
for /f "skip=1 delims=" %%U in ('wmic /node:"!TARGET_PC!" computersystem get username 2^>nul') do (
    REM wmic output includes trailing carriage returns; use a nested for to trim
    for /f "tokens=*" %%A in ("%%U") do (
        if not "%%A"=="" set "LOGGED_USER=%%A"
    )
)

if not defined LOGGED_USER (
    echo No user logged in at the console, or machine is locked/offline.
) else (
    echo Currently logged-in Console User: !LOGGED_USER!
)

endlocal
pause

Dealing with Access Denied Errors

For both qwinsta /server: and wmic /node:, the script must be executed by an account with administrative permissions on the target computer. If you target a workstation as a standard user, you will receive an Access is denied or Error 5 message. Always ensure you are running the script prompt "As Administrator" using an authorized account.

Conclusion

To find out who is logged onto a remote Windows computer via Batch script:

Use qwinsta /server:ComputerName when you need a comprehensive list of all sessions, particularly on servers where users connect via RDP.
Use wmic /node:"ComputerName" computersystem get username when you need a quick query strictly for the user physically sitting at the console (workstations), accepting its limitations regarding locked screens.