Quote:

---

and ofcourse you can check for the loaded user hives.
something like:
for each $key in $HKEY_USERS_KEYS

as only the logged in user's key is loaded.

---

break on


$Win32Admin = createobject("Win32Admin")
if vartypename($Win32Admin) <> "Object"
  ? "@serror"
endif

; Requires KiXtart 4.02 or higher
; You can define the $Computer variable here or an the command line.
;
; Syntax: Kix32 ListLoggedOnUsers.kix $Computer="Name"
;
; Note that if your computer name is like "1 something" the command line
; option may not work
;
If VarTypeName($Computer) = 'Empty'
	$Computer = ""
Endif
$Computer = "bullockha3"

;Create VBS Dictionary Object
$oDict = CreateObject("Scripting.Dictionary")


; Method EnumTrustedDomains(optional $Server)
;   Returns an array of dictionary objects
;   Keys: (sid, name)
;   If a server name is specified, the enumeration is based
;   on the domain where the server resides. If no server is supplied,
;   then the computer where the script is executing will be used by
;   default.
$Domains = $Win32Admin.EnumTrustedDomains($Win32Admin.GetAnyDC(@domain, @wksta))
if @error = 0
	for each $Domain in $Domains
		$oDict.Add($Domain.sid, $Domain.name)

		;uncomment to see the values
		;---------------------------
		;Dim $keys, $Value
		;$keys = $Domain.keys
		;for each $key in $keys
		;	$Value = $Domain.get($key)
		;	? $key + " = " + $Value
		;next
		;?
	next
else
	? "Error: @error  @serror"
endif



For Each $key In fEnumKey($Computer, "HKEY_USERS")
	Dim $acct
   If Left($key,3) = "S-1" and Instr($key,"_") = 0
    $DomainSid = Left($key,instrrev($key,"-")-1)

		$Info = $Win32Admin.LsaLookupSids ($Computer, $key)
		if @error = 0
		    for each $item in $Info
				;uncomment to see the values
				;---------------------------
		        ;$keys = $item.keys
		        ;for each $key in $keys
		        ;    $Value = $item.get($key)
		        ;    ? $key + " = " + $Value
		        ;next
		        ;?

		        ; Note: Be careful here as if you pass more than one SID to
		        ; LsaLookupSids you will get back more than $item.
		        $Account = $item.name
		        $Domain = $oDict.Item($DomainSid)
		        ? "" + $Domain + IIF($domain, "\", "") + $Account
		    next
		else
		    ? "Error: @error  @serror"
		endif


;      $acct = SidToName($key)
;      If $acct = ''
;      	$acct = 'Sid from unknown SAM database.'
;      Endif
;      ? $key + " - " + $acct
   Endif
Next
exit 0




;FUNCTION         fEnumKey($Computer, $Key)
;
;AUTHOR           Howard A. Bullock (habullock@comcast.net)
;
;ACTION           Enumerates registries keys on the specified computer.
;
;SYNTAX           fEnumKey($Computer, $Key)
;
;PARAMETERS       $Computer (Required) -  String value
;                 $Key (Required) -  String value
;
;REMARKS          Do not prefix the computer name with "\\"'s.
;
;RETURNS          Array of keys names.
;
;DEPENDENCIES     KiXtart 4.02
;
;EXAMPLES         fEnumKey("", "HKEY_USERS")
;                 fEnumKey("Remote1", "HKEY_USERS")
;
Function fEnumKey($Server, $Key)
   Dim $Index, $Error
   $Index = 0
   Dim $KeyName[$Index]
   If $Server <> ""
      $Key = "\\" + $Server + "\" + $Key
   Endif

   If KeyExist($Key)
      Do
         $KeyName[$Index] = ENUMKEY($Key, $Index)
         $Error = @Error
         If NOT $Error
            $Index = $Index + 1
            ReDim PRESERVE $KeyName[$Index]
         Else
            $Index = $Index - 1
            ReDim PRESERVE $KeyName[$Index]
         Endif
      Until $Error
   Else
      $KeyName[0] = ""
      Exit 2
   Endif
   $fEnumKey = $KeyName
   Exit 0
Endfunction  

Quote:

---

If you want to know who is logged on to the machine, why not just enumerate your local processes?

If you ignore all the daemon process owners what's left will be the user(s).

If you run full desktops it's even easier - you just need to look for any "explorer.exe" processes.

---

Quote:

---

$id = WMIQuery('Name','Win32_ComputerSystem',$computer)

for each $proc in $id
? $proc
next

---

Quote:

---

UserName
Data type: string
Access type: Read-only

Name of a user that is logged on currently. This property must have a value. In a terminal services session, UserName returns the name of the user that is logged on to the console—not the user logged on during the terminal service session.

---

Quote:

---

Quote:

---

$id = WMIQuery('Name','Win32_ComputerSystem',$computer)

for each $proc in $id
? $proc
next

---

What is that supposed to do? When I run it, it returns my workstation name.

---

Quote:

---

what value are you giving $computer

---