Which Windows tool displays local and remote logged-on users?
Which of the following Windows-based tool displays who is logged onto a computer, either locally or remotely?
Community Insight
The exam tests tool-to-function mapping for Windows user-session enumeration, and the trap is confusing Process Monitor's broad event tracing with PSLoggedon's specific logged-on-user reporting.
This question tests whether you can distinguish Sysinternals tools by function and identify PSLoggedon as the utility that lists local and remote logged-on users on Windows. The page confirms PSLoggedon as the answer and explains why Tokenmon, TCPView, and Process Monitor do not enumerate user sessions.
A frequent mistake is choosing Process Monitor because it sounds like it tracks user activity; it actually traces file, registry, process, and network events rather than listing interactive or remote logon sessions.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
PSLoggedon is the Sysinternals utility built to report who is logged on to a Windows computer, whether locally or through shared resources on a local or remote machine. Its purpose is user-session enumeration, not general process, token, or network-connection monitoring. In the scenario, the requirement is specifically to display logged-on users locally or remotely, which matches PSLoggedon's documented function. The comments reinforce this: aqeel1506 noted that "PSLoggedon is a Windows-based tool from SysInternals" and Elb described how it "displays both the locally logged on users and users logged on via resources." Therefore, option B is the direct and correct tool.Why the Other Options Are Wrong
Tokenmon is associated with monitoring and manipulating Windows access tokens, not with enumerating who is logged on. TCPView shows TCP and UDP endpoint activity, so it can reveal network connections but not interactive or resource-based logon sessions. Process Monitor captures real-time file system, registry, process, and network events; while it may record logon-related process activity, it is not a logged-on-user reporting tool. aqeel1506 summarized this elimination accurately by noting that the alternatives are "not related to user login sessions" or not specifically focused on them. None of these tools provides PSLoggedon's direct local and remote user-session view.Community Comment Notes
One commenter, aqeel1506, walked through the options and correctly separated PSLoggedon from token, connection, and event-monitoring tools. Elb added that PsLoggedOn works for either the local computer or a remote one and displays both locally logged-on users and users logged on via resources. These observations align with the tool's documented behavior and support selecting B rather than the more general monitoring utilities. The community discussion is useful here because it focuses on the exact functional distinction the exam is testing.Official Reference
Exam Strategy
Memorize the Sysinternals tool families by purpose: PsLoggedon for logged-on users, Tokenmon for token activity, TCPView for TCP/UDP endpoints, and Process Monitor for file, registry, process, and network event tracing. When a question asks who is logged on locally or remotely, look for PsLoggedon rather than a broader monitoring tool.
Frequently Asked Questions
Why is Process Monitor not the right tool for logged-on users?
Process Monitor records file, registry, process and network activity; it does not enumerate interactive or remote user sessions like PSLoggedon.
Can PSLoggedon query a remote Windows computer?
Yes, PsLoggedon can report local and resource-based logons for a remote computer when permissions allow.