logged on user

These Windows and Macintosh inspectors return information about the currently logged-on user. With the advent of Terminal Services and Fast User Switching, these inspectors are designed to iterate over all logged on users. Windows Note: If Terminal Services are available (NT/2000/2003/XP/Vista) and enabled, these inspectors iterate over the active and disconnected sessions as returned by WTSEnumerateSessions. Disconnected sessions are those where a user logs on, but is currently inactive. On Vista, the non-interactive session 0 (used for services isolation) is not included. If Terminal Services aren't available, the ACLs on the security descriptor of the "winsta0" window station are examined for user logons. On Windows 9x systems, these inspectors return the user session associated with the registry value "Current User" of "SYSTEM\CurrentControlSet\Control" if it exists. Otherwise, if a shell process process such as Explorer.exe is running, they return a single session associated with an unnamed user (which occurs when the user cancels the 9x login dialog).

Starting from BigFix Version 11.0.5, the Windows inspector has properties for retrieving information about the logon session and last logon. The logon session refers to the logon event that initiated the Windows user session, which is the first interactive logon that created the desktop environment. In contrast, the last logon refers to the most recent logon performed within that session, such as an unlock or a re-authentication. The last logon may differ from the logon session, especially if the session has been reactivated multiple times (for example, after a lock screen). Those properties are valid for Windows versions starting from Windows Vista and Windows Server 2008.

On Windows, the enumerations indicating the logon types correspond to those documented by Microsoft. For more information, see this Audit logon events article.

Parent: user
Version Platforms
8.0.584.0 Mac, Windows
8.2.1078.0 AIX, Debian, HP-UX, Red Hat, SUSE, Solaris, Ubuntu
9.5.13.130 Raspbian

Creation

current user : logged on user
logged on user : logged on user
logged on user of <user> : logged on user

Properties

active of <logged on user> : boolean
activity history of <logged on user> : activity history
last logon time of <logged on user> : time
last logon type number of <logged on user> : integer
last logon type of <logged on user> : string
logon completion time of <logged on user> : time interval
logon session time of <logged on user> : time
logon session type number of <logged on user> : integer
logon session type of <logged on user> : string
name of <logged on user> : string
process id of <logged on user> : integer
remote of <logged on user> : boolean
session id of <logged on user> : integer
session id of <logged on user> : string
sid of <logged on user> : security identifier
tty of <logged on user> : string
user key of <logged on user> : registry key
user of <logged on user> : user