Get list of currently logged in users using WMI (Windows)

[johndoe2374]

Hello everyone.

I'm trying to get a list of currently logged in users for a Windows machine. I know that I can use CMD's "query user", "WMIC /NODE: workstation_name COMPUTERSYSTEM GET USERNAME" or some PowerShell cmdlets to do that, but you'll need to allow this specific command in AllowKey parameter for each agent. Yes, I can create separate config file with that string and copy to every machine's "zabbix_agentd.conf.d" directory, but I want to know if I can reach this goal by using agent's "wmi.get" key (I guess you won't need to allow keys to perform these queries). I wasn't able to find a lot of info about which namespace I should use and how the query syntax will look like.

[Hamardaban]

like this:

 wmi.getall[root\cimv2,"SELECT UserName,Roles from Win32_ComputerSystem"]

[johndoe2374]

Sorry, I've forgot to mention that I want to use that for terminal servers (RDS) to monitor users logged via RDP sessions. So this one returns empty array if retreived from RDS machine:

[{"Roles":["LM_Workstation","LM_Server","NT","Server_NT"]}]

I think that works only for local logins, and I can retreive valid result from any regular workstation.

[Hamardaban]

The syntax of writing the key was not clear to you - I gave you an example.
What kind of request to get the information you need is already a question for "microsoft guru".
try cmd comand "quser", "qwinsta" ?

[johndoe2374]

Well, I thought that someone maybe already solved this. Will investigate further, thanks for help!

[Hamardaban]

try cmd command "quser", "qwinsta" ?

[johndoe2374]

Yep, it's same as "query user". CMD commands work, I just wanted to awoid creating AllowKey parameter for system.run in agent configs. Will need to dive into Win32 classes.