How to See What Users Are Connected & Logged In To a Mac

Mar 25, 2014 - 5 Comments

List user log ins to Mac OS X

If you share your Mac on a network you may be interested to know who is connected to the Mac at any given time. This may include listing currently logged in users through a variety of network protocols, even locally, or perhaps just a history of users logins over a period of time. While OS X Client doesn’t offer the same level of information as OS X Server, you can still find user connection details by using a variety of tools built into all versions of Mac OS X.


We’ll cover finding active user accounts through Activity Monitor, the ‘last’ command, and the ‘who’ command. This is fairly comprehensive, meaning it will include all users who are currently connected and/or actively logged onto a Mac, whether by another user account in the background, a Guest user account, general sharing from public folder access, a user connected through a local network share for the purpose of sharing files with another Mac, network users connected from Windows PC’s or linux machines through SMB, remote logins through SSH and SFTP, just about everything.

See Users with Activity Monitor in OS X

The simplest way to get basic user details is to use Activity Monitor from an Administrator user account. This will be inclusive, but the data is a bit limited for some uses as you’ll see:

  • Launch “Activity Monitor” in OS X, found within /Applications/Utilities/
  • Click on “Users” to sort and group the list by users logged in

Active Network users in Mac OS X Activity Monitor

If you’re looking for a specific user account, you can easily find that user as well as all the processes they are running, be it apps, services, or nothing, and what kind of resources they are using. Choosing the “Network” tab within Activity Monitor will offer details about user network usage as well, helping to indicate if they are copying or receiving files from the Mac to their own.

To properly make use of this information, you’ll want some basic understanding of what user accounts exist on the Mac (i.e. who is found in the /Users/ folder), but also understand the root / superuser account, in addition to services and daemon agents running in the background on all Macs, which may show up in the Users list with names like spotlight, netbios, usbmuxd, locationd, coreaudiod, window server, mdnsresponder, networkd, appleevents, amongst many others.

Ultimately, the ‘last’ command may prove more useful for those comfortable with the command line.

List Connected Users & Log Ins to the Mac with “last”

The command line tool ‘last’ offers a simple way to see a history of what users have logged into a given Mac, both locally and also through a network connection like AFP, the default sharing protocol for Macs. Using ‘last’ is simple enough, but you should have some familiarity with the command line to get the most use out of the utility and to comprehend the output.

Launch Terminal app, found with in /Applications/Utilities/ and enter the following command string to see a full list of user logins

last

To search for a specific user login, send the output of last through grep like so:

last |grep USERNAME

For example, to search last output for the user “OSXDaily” you would use the following command:

last |grep OSXDaily

This is case sensitive, so the user ‘osxdaily’ would be unidentified while “OSXDaily” will return positive results, thus be sure to use proper casing.

This will produce output looking something like the following, including all login dates, and when possible, the IP source of the connecting machine if the user was logged in through a network connection (in this screenshot example, the origin IP was identified as 192.168.1.4):

List of users connected to a Mac

If no IP or network origin is shown, this indicates the user is logged in directly on the Mac, either through the standard OS X login process, Fast User Switching, su / sudo, or something similar.

To see who is currently logged in through AFP, you can also use the following last command syntax:

last |grep "logged in"

Users who are actively logged in, whether through a remote connection or the local machine, will show “still logged in” as their status.

A potential hiccup for the ‘last’ command appears when you have users logged in through the SMB / Windows protocol, which is optionally enabled within Mac OS X to allow file sharing between a Windows PC and Macs, and users logged in to the Mac through SMB will not show always how up through the ‘last’ command output. This leaves a few other options, like using ‘netstat’ or, perhaps easier for most users, browsing in Network Activity from the Activity Monitor as was outlined at the beginning of this article.

See Logged In SSH / Telnet Users with ‘who’

Finally, you can see who is currently connected to a Mac through an active SSH connection or the antiquated Telnet protocol by using the classic ‘who’ command from the terminal:

who

This shows all instances of your own user account, as well as logged in users through a connection exterior to the Mac.

See what users are connected to a Mac

Know of another way to see what users are currently logged into a Mac? Share it with us in the comments!

Enjoy this tip? Subscribe to the OSXDaily newsletter to get more of our great Apple tips, tricks, and important news delivered to your inbox! Enter your email address below:

Related articles:

Posted by: Paul Horowitz in Mac OS X, Tips & Tricks

5 Comments

» Comments RSS Feed

  1. Geoff Winters says:

    Very thorough as usual, love the info thanks guys!

    Now, I wish you could just see a simple list of “Connected Users” in the “Sharing” control panel, is that so hard to ask of Apple?

  2. Ta0 says:

    You can also use netstat to find the connections through AFP and SMB

    For AFP (Mac to Mac)

    netstat -na | grep 548

    and

    netstat -na | grep 427

    and for Samba (Mac to PC)

    netstat -na |grep 445

    and

    netstat -na |grep 139

  3. Georg Rabensteiner says:

    wow… pretty nice tips! THX!

  4. Fischmuetze says:

    The command “w” is the quicker way to display who is logged in and what they are doing

    • Zell says:

      DAMN it !

      “w” command is already more powerful than “who” ! I’m going to take a look at the man page !
      Thanks for the tips !

Leave a Reply

 

Shop for Apple & Mac Deals on Amazon.com

Subscribe to OSXDaily

Subscribe to RSS Subscribe to Twitter Feed Follow on Facebook Subscribe to eMail Updates