Description: Users that are currently logged on.
What The Data Shows: See who is performing specific actions on a workstation.
SQL:
Select
User,
Logon_Domain,
Session_ID,
Logon_Time,
Logon_Server,
Logon_Script
FROM Logon_Sessions
WHERE Logon_Type like "Interactive" AND Logon_Server <> "";
