The VMware Carbon Black Tech Zone is live! Checkout this great resource: Mastering Carbon Black Audit & Remediation.

Get Actively Logged On Domain Users

Description: Users that are currently logged on.

What The Data Shows: See who is performing specific actions on a workstation.

SQL: 

Select
User,
Logon_Domain,
Session_ID,
Logon_Time,
Logon_Server,
Logon_Script 
FROM Logon_Sessions
WHERE Logon_Type like "Interactive" AND Logon_Server <> "";

 

2 Comments
esullivan
Carbon Black Employee

Hey @cstamand  appreciate your contribution!  We'll vet this submission and if it runs as expected we'll change this status of your query from Under Review to CB Approved.

Thanks again!

Ed Sullivan

tmccormack
Carbon Black Employee
Status changed to: Approved

Awesome! Thank you for submitting.