7

Example: I am logged in as user TestUser. From this user I am going to run a command line as an administrator named AdminUser.

Is it possible from this command line to determine the name of the currently logged in TestUser?

I already have scheduled task which is always running as AdminUser, but in its action (batch file), I need to name of the currently logged in user.

Any ideas?

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
dEVIANT
  • 249
  • 2
  • 4
  • 14
  • Can you clarify what is meant by "currently logged user"? Are you restricting this to the console? Do Remote Desktop connections count? If this is a server OS, how would you choose between RDP cilents? – mojo Jan 22 '15 at 15:55
  • not sure, because can't try at the moment, but does `tasklist /v |find "explorer.exe"` help? – Stephan Jan 22 '15 at 18:53
  • 1
    Possible duplicate of *[How do you find the current user in a Windows environment?](http://stackoverflow.com/questions/1607271/how-do-you-find-the-current-user-in-a-windows-environment)*. – Peter Mortensen May 24 '16 at 13:03

3 Answers3

7

As far as I know this is not really possible. Depending on how much you know about the environment of the users, the following might be a workaround however:

The command

qwinsta

will give you a list of sessions for the computer. Within these sessions one will be the active one, so if this program is used in an interactive session only this will basically contain the "logged in user" as you described it (it is far more complicated really, there could be many users logged on but only one can be active and I just hope you know enough about the usage scenario of your program to make use of that). You could parse the output and work with that username.

Of course this is a dirty hack and it assumes that during the run time of your task there is no chance that users change.

Also though I chose the qwinsta.exe because it is a very basic approach that needs no API calls or something I am still not sure if the CMD has sufficient parsing capabilities to get the necessary information for you.

Syberdoor
  • 2,521
  • 1
  • 11
  • 14
  • Thanks. This solution will normally works. But in case my not. I will tell you why. Basically i need to run batch file only on admin log out. So my task is triggered on Security event 4647 (log off event). So i test your proposal, and there are no more active sessions. I was trying to perform this through group policy log off scripts via registry, but it is very unstable and does not work for me. – dEVIANT Jan 23 '15 at 08:32
  • 1
    So you don't need the active user, but the last active one? In that case I would propose another workaround. If you can guarantee no remote sessions you can try the key HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\LastLoggedOnUser this is basically the key windows uses to show you the last user on the logon screen. Remote sessions are not saved there... If you have them I would say write a program that overwrites a reg key or file with the userinfo on every log in and query your own info later – Syberdoor Jan 23 '15 at 09:03
4

%username% variable contains.. well, the user name.

echo/%username%

EDIT

As you said, because you are in a scheduled task, you can get the user name from Windows Registry

@echo off
for /f "tokens=3" %%a in ('reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\1 /v LoggedOnUserName') do (
set "user=%%a")
set "user=%user:.\=%"
echo/%user%

Now %user% variable contains the logged user name.

Rafael
  • 3,042
  • 3
  • 20
  • 36
  • 1
    Yes, but this will returns AdminUser, as he is executor of scheduled tasks. Even if in windows you are logged as TestUser. I try this, also also whoami command :) – dEVIANT Jan 22 '15 at 12:12
  • 1
    This will not work if there are users with disconnected sessions. However if dEVIANT can rule that scenario out it is a lot less crazy than my idea. – Syberdoor Jan 22 '15 at 14:04
  • In session data i had 1,2,3 keys, in one is my admin user, even when i am logged as test user :/ – dEVIANT Jan 23 '15 at 08:32
  • @dEVIANT What about LogonUI key right above Background key? Is that key of your user? – Rafael Jan 23 '15 at 09:53
2

Here is a quick way to make this happen using a batch file would be this command:

for /F "tokens=1,2" %%i in ('qwinsta /server:%COMPUTERNAME% ^| findstr "console"') do set tempVar=%%j

echo %tempVar% will show whatever user is actually logged in. Not the user who launched the batch file.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Ben
  • 21
  • 1