LogonSessions

The Command Prompt is still widely used today for advanced operations which might result in error if used with a poorly made GUI. Related tools range, depending on the result which needs to be obtained. In case logon information is the main subject, then LogonSessions can display various details about past Windows login attempts.

First of all, the utility comes in a lightweight package, which doesn’t require any kind of installation to function. This provides enough flexibility to be used on other computers, directly from a thumb drive. Note that it’s best to use an elevated instance of the Command Prompt, so that the utility can properly gather all requested details.

Running the utility without any switches shows logon history for quite a while back. In this regard, it’s recommended to increase buffer size to be able to analyze entire generated content. In a couple of seconds, returned details show logon session ID, user name, authentication package, logon type, session, sid, time, logon server, and DNS.

There are three switches which can be applied. Choosing the -p switch includes all processes which were already running at the time of analysis and logon. The other two help with exporting info fields. These can be combined, with export options for comma, or tab delimited values.