Skip to main content
Operating system & services

Logged-on User

Check whether users are logged on to Windows devices and get warned depending on the alert mode, for example before maintenance work.

The Logged-on User check determines whether users are currently logged on and lists their names. Depending on the alert mode, it only reports, warns when a user is logged on, or warns when nobody is logged on, for example before you start maintenance work. It runs only on Windows (x64 and ARM64), locally through the octoja agent, every 5 minutes by default. Linux and macOS are not supported.

Prerequisites

  • You need the Monitoring Check Management permission.
  • The agent runs as Local System; there is nothing to set up on the device.

Steps

  1. Go to Devices and open the device.
  2. Click the Checks tab → Add Check → Logged-on User.
  3. Choose the Alert mode.
  4. Click Add Check.

To assign the check to many devices at once, use a config package.

Settings

FieldTypeRequiredDefaultDescription
Alert modeChoiceNoInformational (never alert)Informational (never alert), Warn when a user is logged on, or Warn when no user is logged on.

Results

Alert modeUser logged onNo user logged on
Informational (never alert)OKOK
Warn when a user is logged onWarningOK
Warn when no user is logged onOKWarning

The check reports at most Warning, never Critical. If the session query fails, it reports Error; if it returns no output at all, Warning.

The result shows User(s) logged on or No user logged on, plus the names of the logged-on users (at most 50).

Session detection

  • The check evaluates the session list from quser. Every session listed there counts as a logged-on user, including a disconnected Remote Desktop session.
  • If quser returns no sessions, for example because the program is missing on the device, the device counts as having no logged-on user. With Warn when no user is logged on, the check then reports Warning.

See also: Set up alerts for a check

Was this helpful?

Still need help? Ask the team