Overview
Enumerate all logon sessions currently active on the system. This command provides detailed information about each session including user identity, logon type, and session characteristics for targeting and operational planning.Syntax
Optional Parameters
Display information for specific LUID only
Examples
Session Information
Displayed Details
Displayed Details
Session Attributes:
- LUID (Logon Session Identifier)
- Username and domain
- Logon type and time
- Authentication package
- Session state and characteristics
- 2: Interactive (console logon)
- 3: Network (remote authentication)
- 4: Batch (scheduled task)
- 5: Service (service account)
- 7: Unlock (workstation unlock)
- 8: NetworkCleartext (IIS authentication)
- 9: NewCredentials (RunAs with /netonly)
- 10: RemoteInteractive (RDP/Terminal Services)
- 11: CachedInteractive (cached domain credentials)
Use Cases
Session Analysis
Session Analysis
Target Identification:
- Find high-privilege user sessions
- Identify administrative logons
- Locate service account sessions
- Map user activity patterns
- Plan cross-session ticket operations
- Identify accessible session contexts
- Target specific user sessions
- Assess system security posture
Session Targeting
Session Targeting
High-Value Sessions:
- Domain administrator sessions
- Service account sessions with delegation
- Interactive administrative sessions
- Recent authentication activities
- Session age and activity
- Authentication package used
- Network vs. interactive sessions
- Cached vs. live authentication
Output Analysis
Understanding Results
Understanding Results
Sample Output:Key Elements:
- LUID identifies session for targeting
- LogonType indicates session characteristics
- AuthenticationPackage shows credential type
- Recent LogonTime indicates active sessions
Integration Workflows
Session Discovery and Targeting
Session Discovery and Targeting
Complete Workflow:
Cross-Session Operations
Cross-Session Operations
Multi-Session Analysis:
Session Types Analysis
Logon Type Significance
Logon Type Significance
Interactive Sessions (2, 7, 10, 11):
- User actively logged in
- Likely to have cached credentials
- May have elevated privileges
- Good targets for credential extraction
- Remote authentication only
- May have limited cached credentials
- Useful for understanding network access
- May indicate lateral movement
- Automated service accounts
- Often have delegation rights
- May run with high privileges
- Good targets for persistence
Operational Security
Detection Considerations
Detection Considerations
Monitoring Indicators:
- Process accessing LSA session information
- Enumeration of multiple logon sessions
- Correlation with other suspicious activities
- Unusual session analysis patterns
- Limit frequency of enumeration
- Focus on specific high-value sessions
- Use during normal business hours
- Correlate with legitimate activities
Related Commands
currentluid- Display current session LUIDdump- Extract tickets from specific sessionsptt- Inject tickets into specific sessionstriage- Quick session ticket overview