Enumerate Logged-On Users with the Workstation Service

{% include "../../.gitbook/includes/admin-privs.md" %}

To enumerate logged on users on a remote target, the following option can be used:

nxc smb <target> -u <username> -p <password> --loggedon-users

Note that if a username is returned, you will be able to impersonate that user's primary token to run commands on its behalf.

In case you want to hunt a specific user, you can specify its username the following way:

nxc smb <target> -u <username> -p <password> --loggedon-users username