logon_sessions

Windows Logon Session.

Platform support

Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: logon_sessions

  • Windows

Table schema

Name

Type

Description

logon_id

INTEGER

A locally unique identifier (LUID) that identifies a logon session.

user

TEXT

The account name of the security principal that owns the logon session.

logon_domain

TEXT

The name of the domain used to authenticate the owner of the logon session.

authentication_package

TEXT

The authentication package used to authenticate the owner of the logon session.

logon_type

TEXT

The logon method.

session_id

INTEGER

The Terminal Services session identifier.

logon_sid

TEXT

The user’s security identifier (SID).

logon_time

BIGINT

The time the session owner logged on.

logon_server

TEXT

The name of the server used to authenticate the owner of the logon session.

dns_domain_name

TEXT

The DNS name for the owner of the logon session.

upn

TEXT

The user principal name (UPN) for the owner of the logon session.

logon_script

TEXT

The script used for logging on.

profile_path

TEXT

The home directory for the logon session.

home_directory

TEXT

The home directory for the logon session.

home_directory_drive

TEXT

The drive location of the home directory of the logon session.

Query examples

select * from logon_sessions;