logon_sessions

Windows Logon Session.

Platform support

Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: logon_sessions

  • Windows

Table schema

Name Type Description
logon_id INTEGER A locally unique identifier (LUID) that identifies a logon session.
user TEXT The account name of the security principal that owns the logon session.
logon_domain TEXT The name of the domain used to authenticate the owner of the logon session.
authentication_package TEXT The authentication package used to authenticate the owner of the logon session.
logon_type TEXT The logon method.
session_id INTEGER The Terminal Services session identifier.
logon_sid TEXT The user’s security identifier (SID).
logon_time BIGINT The time the session owner logged on.
logon_server TEXT The name of the server used to authenticate the owner of the logon session.
dns_domain_name TEXT The DNS name for the owner of the logon session.
upn TEXT The user principal name (UPN) for the owner of the logon session.
logon_script TEXT The script used for logging on.
profile_path TEXT The home directory for the logon session.
home_directory TEXT The home directory for the logon session.
home_directory_drive TEXT The drive location of the home directory of the logon session.

Query examples

select * from logon_sessions;