The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →psloggedon.exe is Microsoft Sysinternals’ PsLoggedOn command-line utility. It reports users logged on locally and users connected through resource shares on a local or remote Windows computer. A copy obtained from the official Microsoft Sysinternals PsTools package is legitimate; an antivirus warning can still appear because malware has used PsTools. The practical fixes for “psloggedon.exe is not recognized,” remote-query failures, incomplete results and security alerts are to use the official package, run the documented syntax, and check the permissions and network services that remote queries require.
What psloggedon.exe is
PsLoggedOn is a small, portable Windows administration utility in the Microsoft Sysinternals PsTools suite. It is an executable rather than a Windows service. It does not need to start with Windows, remain running in the background or be installed through a setup wizard. You copy the executable to a folder on your computer and run it from Command Prompt or PowerShell.
As an Amazon Associate I earn from qualifying purchases.
The utility answers two related questions:
- Which accounts have a locally loaded user profile on this computer?
- Which users are connected to this computer through Windows resource shares?
You can query the current computer, name a remote computer, or supply a username to search network computers for systems where that account is logged on. Microsoft lists PsLoggedOn version 1.35, with support for Windows Vista and later client versions and Windows Server 2008 and later server versions. The Sysinternals page for that version was published in 2016 and lists a March 23, 2021 update, so check the current Microsoft package if your environment has stricter compatibility or software-version requirements.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How PsLoggedOn determines who is logged on
Local logons come from loaded profiles
PsLoggedOn defines a local logon by looking for user profiles that are loaded in the Windows Registry. It scans the SID-named keys beneath HKEY_USERS and translates those security identifiers into account names. This is different from simply listing every account that exists or every sign-in event recorded in an event log.
#1 Best Overall
- Spacious Design: Measuring 21.1" wide and 14.1" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy ergonomic support with the integrated cushioned wrist rest.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a sleek black carbon color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.8 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
As a result, an account can be absent from the local portion of the output when its profile is not loaded. Conversely, a service, disconnected session or other process that has a loaded profile can affect what appears. The result is a snapshot of loaded profiles at query time, not a complete historical audit of every interactive sign-in.
Resource-share sessions come from NetSessionEnum
For users connected through shared folders or other Windows resources, PsLoggedOn uses the Windows NetSessionEnum API. These sessions represent network connections to the computer’s resources and are a separate category from the locally loaded profiles.
Remote queries need more than a reachable host
When you query another computer, PsLoggedOn must access the target’s Registry and obtain resource-session information. Microsoft documentation describes the remote Registry connection through the RegConnectKey mechanism. Credentials, account rights, firewall and network policy, name resolution, and the target’s ability to expose those interfaces all affect the result. A successful ping alone does not prove that PsLoggedOn can complete a remote query.
Free tools Windows power users keep installed
One-click scans. No signup required.
Is psloggedon.exe safe or a virus?
The safest baseline is provenance. The Microsoft Sysinternals copy is a legitimate administrative utility. Microsoft’s PsTools documentation says: “None of the PsTools contain viruses, but they have been used by viruses, which is why they trigger virus notifications.” That statement explains why an endpoint product may flag the file without proving that the particular copy on your computer is malicious.
Evaluate the alert in context rather than dismissing it automatically. Confirm that you downloaded PsLoggedOn as part of the Microsoft Sysinternals PsTools package, check the file’s location and metadata, and follow your organization’s signature, reputation and malware-scanning policy. A file with an unexpected path, altered metadata or a download origin you cannot verify should be treated as untrusted and replaced with a fresh copy from Microsoft.
Rank #2
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Do not download a replacement executable from a random “DLL fix,” driver or file-sharing site. Such sites can rename unrelated software as psloggedon.exe, bundle unwanted programs or provide a modified binary. If security software quarantined a suspicious copy, preserve the alert details for your administrator, remove that copy and obtain the official package instead of restoring an unknown file.
What the command syntax means
The documented syntax is:
psloggedon [-] [-l] [-x] [\computername | username]
| Part | Purpose | When to use it |
|---|---|---|
psloggedon |
Queries the current computer and displays local and resource-share logons. | Start here to confirm that the utility runs and to see both categories. |
-l |
Shows only local logons. | Use when loaded local profiles are the only information you need. |
-x |
Suppresses logon times. | Use when you need a shorter result or do not need timestamps. |
\computername |
Queries a named remote computer. | Use after a local test succeeds and remote access has been authorized. |
username |
Searches network computers for systems where the supplied user is logged on. | Use for an account-focused search; it is not the same as querying one named host. |
-? or the documented - help option |
Displays supported options. | Use it to confirm the syntax available in the copy you are running. |
Install PsLoggedOn without a setup program
- Download PsLoggedOn as part of the official Microsoft Sysinternals PsTools package.
- Extract the package into a folder you control, such as a dedicated administrative-tools directory. Keep the files together and retain the original archive if your organization requires software provenance.
- Open Command Prompt or PowerShell. The quickest first test is to change to the extracted folder, or open a terminal directly in that folder.
- Run
psloggedon -?to display the options. If the shell cannot find the command, run it with a relative path such as.psloggedon.exein PowerShell or with the full path to the executable. - Run
psloggedonagainst the current computer before attempting a remote query. A local result confirms that the executable itself is present and can start.
Microsoft’s installation guidance is simply to copy the executable onto an executable path and type psloggedon. If you want to run it from any directory, add the folder containing the executable to the user or system PATH, then open a new terminal so it receives the updated environment. Adding a folder to PATH is optional; using the full path avoids changing system-wide settings.
Examples for common tasks
List both categories on the current computer
psloggedon
This is the broadest normal query. Read the output as separate local-profile and resource-share information where the utility labels those categories.
Show only local logons
psloggedon -l
This deliberately omits resource-share sessions. It is useful when you are checking who has a loaded profile on the console or server and do not want network-share connections mixed into the result.
Rank #3
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
Hide logon times
psloggedon -x
The -x switch changes presentation by suppressing logon times; it does not change which session categories PsLoggedOn can query.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuery one remote computer
psloggedon \COMPUTER01
Replace COMPUTER01 with the target’s computer name. Test the local command first, then verify that your account is allowed to access the target Registry and session interfaces.
Search for a username across network computers
psloggedon alice
Supplying a username requests a network search for computers where that account is logged on. The search depends on the network visibility and permissions available to the account running the command, so an empty or partial result is not proof that the user is logged off everywhere.
Fix “psloggedon.exe is not recognized” and file-not-found errors
Confirm that the file exists
Open the folder where you extracted PsTools and check that psloggedon.exe is present. If the archive was never extracted, or the file was deleted or quarantined, the shell cannot start it. Re-extract the official package or obtain a fresh official copy after resolving any security-policy issue.
Run from the correct folder
In Command Prompt, use cd to change to the extraction directory and then run psloggedon. In PowerShell, use .psloggedon.exe when the current directory is not searched automatically. A full-path example is "C:ToolsPsToolspsloggedon.exe". Quotation marks are needed when a path contains spaces.
Rank #4
- Anti-Slip Surface - Transform your laptop into a mobile workstation with the AboveTEK portable laptop lap desk. The anti-slip surface provides a strong grip for laptops up to 15.6 inches(Diagonal), while the double rubber strip on the bottom ensures a stable display or typing experience on your lap, couch, or bed.
- Retractable Mouse Pad - Retractable laptop mouse pad extends on both directions for the left/right handed with elevation along the edges for stopping mouse from falling off. The size of laptop tray is 14" X 9.7" and the size of mouse pad is 7.4" X 6.1".
- Effective Heat Shield - The effective heat shield made of sturdy and thick material protects your laptop from overheating. Prioritizes your comfort and safety, an ideal lap pad or board for working anywhere.
- EASY to Carry and Store - With an ergonomic and simplistic design, the lap desk is portable to store in a backpack. Only 15" in size, 2.2 lb of weight and with slim 0.6 inch thickness, it is ready to be easily carried around.
- Widely Applicable - The smooth platform accommodates laptops and tablets up to 15.6 inches(Diagonal), making it a versatile accessory and one of the best gifts for mom, dad, students and professionals. Perfect for use as a laptop bed tray or tablet holder anywhere at home, library, or park.
Use PATH only if you need a global command
If you expect to call PsLoggedOn from many directories, add its containing folder to PATH through Windows Environment Variables, then open a new Command Prompt or PowerShell window. A previously opened shell keeps its old environment and may continue reporting that the command is not recognized.
Check for a misleading filename
Windows can hide known extensions in File Explorer. Make sure the file is actually named psloggedon.exe, not psloggedon.exe.exe or a similarly named script. Do not “fix” the problem by downloading a DLL from an unrelated site; PsLoggedOn is distributed as an executable in the PsTools package.
Fix remote-query failures and “access denied” results
Establish a local baseline
Run psloggedon or psloggedon -l on the computer where you are working. If the local command fails, solve the path, extraction or security issue before investigating the network.
Verify the target name and network path
Check the spelling of the computer name, DNS resolution and basic network reachability. If your organization uses a firewall, segmented network or VPN, confirm that policy permits the management traffic required for remote Registry and resource-session queries. A host being powered on does not guarantee that those interfaces are reachable from your workstation.
Use an account with the necessary rights
Remote access requires credentials that the target accepts for Registry and session enumeration. Sign in with an authorized administrative or delegated account according to your organization’s policy, and avoid embedding passwords in scripts or command history. If the account is valid but lacks the required rights, PsLoggedOn can return access-denied or incomplete information.
Best Value
- Spacious Design: Measuring 21.1" wide and 12" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy laptop support with the integrated device ledge.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a blush pink color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.14 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Check remote Registry availability
PsLoggedOn’s local-profile calculation on another computer requires Registry access. If the target’s Remote Registry capability is disabled by policy, stopped, blocked by a firewall or restricted by security software, the remote local-logon portion cannot be obtained. Have an administrator verify the target configuration rather than weakening security controls broadly.
Check resource-session access separately
The resource-share portion uses NetSessionEnum. A target may permit one interface but not the other, so you can receive local-profile results without a complete list of share sessions, or the reverse. Interpret the labels in the output and investigate each prerequisite instead of assuming that a partial result represents every logged-on user.
Account for PsLoggedOn’s authentication side effect
Microsoft warns that a remote query can show the account you are using as connected through a resource share. PsLoggedOn must authenticate to reach the remote Registry, and that authentication itself can create a session visible to the utility. Do not treat that entry alone as evidence that another person is actively using the target computer.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhy output may look incomplete or surprising
A loaded profile is not the same as a sign-in history
Because local detection is based on HKEY_USERS, a user session without a loaded profile may not appear in the local section. If you need a historical record of sign-ins, use the appropriate Windows auditing and event-log tools; PsLoggedOn is a point-in-time enumeration utility.
Do not confuse local and share sessions
A person connected to a shared folder may appear under resource-share information without being interactively signed in at the target’s console. Conversely, a local profile can be loaded even when there is no current file-share connection. Use default mode when you need both categories and reserve -l for an intentional local-only check.
Expect differences between snapshots
Sessions can connect or disconnect while the command runs. Results from two computers, or from two runs minutes apart, are not guaranteed to match. Record the computer name, command and time when you need a defensible administrative note.
What to do when antivirus or endpoint protection flags the file
- Stop using the flagged copy until you establish where it came from.
- Confirm that the download was the Microsoft Sysinternals PsTools package and that the executable is in the folder where you expected it.
- Review the security product’s detection name, file hash or reputation details and run the scans required by your organization.
- Compare the result with a freshly downloaded official package. If the original file was altered, renamed or bundled with other software, discard it.
- Ask your security administrator whether the approved Sysinternals utility may be allow-listed for the specific administrative task. Keep any exception narrow and auditable.
Microsoft’s warning about PsTools being used by viruses explains a reputation-based or dual-use alert, but it does not override your organization’s controls. Never disable antivirus protection globally just to run PsLoggedOn, and never restore a quarantined file whose origin you cannot verify.
Recommended Free Tools
When to remove or replace psloggedon.exe
PsLoggedOn is portable, so there is normally no uninstaller. If you no longer need it, close the terminal, remove the executable and archive, and remove any folder you added to PATH. If you suspect tampering, delete the entire untrusted copy, preserve the security alert and obtain the official package again. Removing the file does not investigate other persistence or malware issues; follow your incident-response process if the alert indicates a broader compromise.
Quick Recap
A practical decision checklist
- Need the current computer’s local and share sessions? Run
psloggedon. - Need only loaded local profiles? Add
-l. - Need a cleaner result without timestamps? Add
-x. - Need another computer? Use
\computernameonly after local execution, name resolution, credentials, remote Registry access and network policy are confirmed. - Need to find a user across computers? Supply the username, and treat the result as dependent on network visibility and permissions.
- Command not found? Run from the extraction folder, use a full path, or update
PATHand open a new shell. - Security alert? Verify Microsoft provenance and follow your security team’s scanning and allow-list process; do not use an unofficial replacement.
If you want an optional shortcut for Windows errors beyond this specific command-line check, Outbyte PC Repair can look for more than 100 common Windows issues, adjust selected system settings, clean temporary and cache files, provide privacy and vulnerability checks, and record app crashes. It complements antivirus software rather than replacing it; results vary and no tool repairs every crash. It runs on Windows 11, 10, 8 and 7, with a free trial by category for at least two days before a subscription.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
