Which Windows tool displays local and remote logged-on users?
Short answer
B PSLoggedon is the Sysinternals tool that lists users logged on locally or through resources on a local or remote Windows computer.
Question
Key Takeaways
The exam tests tool-to-function mapping for Windows user-session enumeration, and the trap is confusing Process Monitor's broad event tracing with PSLoggedon's specific logged-on-user reporting.
This question tests whether you can distinguish Sysinternals tools by function and identify PSLoggedon as the utility that lists local and remote logged-on users on Windows. The page confirms PSLoggedon as the answer and explains why Tokenmon, TCPView, and Process Monitor do not enumerate user sessions.
Common mistake: A frequent mistake is choosing Process Monitor because it sounds like it tracks user activity; it actually traces file, registry, process, and network events rather than listing interactive or remote logon sessions.
Expert Analysis
Why the Answer Is Correct
PSLoggedon is the Sysinternals utility built to report who is logged on to a Windows computer, whether locally or through shared resources on a local or remote machine. Its purpose is user-session enumeration, not general process, token, or network-connection monitoring. In the scenario, the requirement is specifically to display logged-on users locally or remotely, which matches PSLoggedon's documented function. The comments reinforce this: aqeel1506 noted that "PSLoggedon is a Windows-based tool from SysInternals" and Elb described how it "displays both the locally logged on users and users logged on via resources." Therefore, option B is the direct and correct tool.
Why the Other Options Are Wrong
Tokenmon is associated with monitoring and manipulating Windows access tokens, not with enumerating who is logged on. TCPView shows TCP and UDP endpoint activity, so it can reveal network connections but not interactive or resource-based logon sessions. Process Monitor captures real-time file system, registry, process, and network events; while it may record logon-related process activity, it is not a logged-on-user reporting tool. aqeel1506 summarized this elimination accurately by noting that the alternatives are "not related to user login sessions" or not specifically focused on them. None of these tools provides PSLoggedon's direct local and remote user-session view.
Community Comment Notes
One commenter, aqeel1506, walked through the options and correctly separated PSLoggedon from token, connection, and event-monitoring tools. Elb added that PsLoggedOn works for either the local computer or a remote one and displays both locally logged-on users and users logged on via resources. These observations align with the tool's documented behavior and support selecting B rather than the more general monitoring utilities. The community discussion is useful here because it focuses on the exact functional distinction the exam is testing.
Official Reference
https://learn.microsoft.com/en-us/sysinternals/downloads/psloggedon
This link opens the official vendor documentation in a new tab.
Exam Strategy
Memorize the Sysinternals tool families by purpose: PsLoggedon for logged-on users, Tokenmon for token activity, TCPView for TCP/UDP endpoints, and Process Monitor for file, registry, process, and network event tracing. When a question asks who is logged on locally or remotely, look for PsLoggedon rather than a broader monitoring tool.
Frequently Asked Questions
Why is Process Monitor not the right tool for logged-on users?
Can PSLoggedon query a remote Windows computer?
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
aqeel1506 👍 1The other options are not correct: A. Tokenmon: A tool for monitoring and manipulating Windows tokens, not related to user login sessions. C. TCPView: A tool for monitoring TCP and UDP connections, not related to user login sessions. D. Process Monitor: A tool for monitoring system events, including process creation and thread activity, but not specifically focused on user login sessions.
-
aqeel1506 👍 1The correct answer is B. PSLoggedon. PSLoggedon is a Windows-based tool from SysInternals that displays information about users logged onto a computer, including: Local users Remote users (via Remote Desktop or other remote access methods) Users logged in via a terminal services session PSLoggedon provides a convenient way to monitor and manage user sessions on a Windows system.
-
Elb 👍 1B > PsLoggedOn is an applet that displays both the locally logged on users and users logged on via resources for either the local computer, or a remote one.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.