Windows Logon Sessions (osquery)

Description: This osquery command will list all Windows users that are currently logged on

SQL:

select * from logon_sessions;

# lists interactive users where the logon server is not blank
select user, logon_domain, session_id, logon_time, logon_server, logon_script
from logon_sessions
where logon_type like "interactive" and logon_server <> "";

Operating Systems: Windows only

Reference:

• https://osquery.io/schema/current#logon_sessions
• https://github.com/osquery/osquery/blob/master/specs/windows/logon_sessions.table