Forum Discussion
log search showing logged on users
Hi Jan,
Is this what you are looking for:
SecurityEvent
| where EventID == 4624
| where ( LogonTypeName == "3 - Network" )
| where ( Computer == "ad server" )
| where AccountType == "User"
| summarize dcount(TargetAccount)?
It would show you total number of users that logged on to the server but not the number of users that are currently logged on.
To do this, you need to left Join the list of users on the 4624 records with the list of users that have 4634 or 4647 records. Those that doesn't have a match are still logged on.
Hope this helps,
Meir :->
MicrosoftHi Jan,
Is this what you are looking for:
SecurityEvent
| where EventID == 4624
| where ( LogonTypeName == "3 - Network" )
| where ( Computer == "ad server" )
| where AccountType == "User"
| summarize dcount(TargetAccount)
?
It would show you total number of users that logged on to the server but not the number of users that are currently logged on.
To do this, you need to left Join the list of users on the 4624 records with the list of users that have 4634 or 4647 records. Those that doesn't have a match are still logged on.
Hope this helps,
Meir :->
That help, thank you, i completly missed the dcount parameter.
Now i just have to get the joins to work.
Ragards
Jan Dam
