How to See What Users Are Connected & Logged In To a Mac

If you share your Mac on a network you may be interested to know who is connected to the Mac at any given time. This may include listing currently logged in users through a variety of network protocols, even locally, or perhaps just a history of users logins over a period of time. While Mac OS X Client doesn’t offer the same level of information as Mac OS X Server, you can still find user connection details by using a variety of tools built into all versions of Mac OS X.

We’ll cover finding active user accounts through Activity Monitor, the ‘last’ command, and the ‘who’ command. This is fairly comprehensive, meaning it will include all users who are currently connected and/or actively logged onto a Mac, whether by another user account in the background, a Guest user account, general sharing from public folder access, a user connected through a local network share for the purpose of sharing files with another Mac, network users connected from Windows PC’s or linux machines through SMB, remote logins through SSH and SFTP, just about everything.

See Users with Activity Monitor in Mac OS X

The simplest way to get basic user details is to use Activity Monitor from an Administrator user account. This will be inclusive, but the data is a bit limited for some uses as you’ll see:

• Launch “Activity Monitor” in Mac OS X, found within /Applications/Utilities/
• Click on “Users” to sort and group the list by users logged in

If you’re looking for a specific user account, you can easily find that user as well as all the processes they are running, be it apps, services, or nothing, and what kind of resources they are using. Choosing the “Network” tab within Activity Monitor will offer details about user network usage as well, helping to indicate if they are copying or receiving files from the Mac to their own.

To properly make use of this information, you’ll want some basic understanding of what user accounts exist on the Mac (i.e. who is found in the /Users/ folder), but also understand the root / superuser account, in addition to services and daemon agents running in the background on all Macs, which may show up in the Users list with names like spotlight, netbios, usbmuxd, locationd, coreaudiod, window server, mdnsresponder, networkd, appleevents, amongst many others.

Ultimately, the ‘last’ command may prove more useful for those comfortable with the command line.

List Connected Users & Log Ins to the Mac with “last”

The command line tool ‘last’ offers a simple way to see a history of what users have logged into a given Mac, both locally and also through a network connection like AFP, the default sharing protocol for Macs. Using ‘last’ is simple enough, but you should have some familiarity with the command line to get the most use out of the utility and to comprehend the output.

Launch Terminal app, found with in /Applications/Utilities/ and enter the following command string to see a full list of user logins

last

To search for a specific user login, send the output of last through grep like so:

last |grep USERNAME

For example, to search last output for the user “OSXDaily” you would use the following command:

last |grep OSXDaily

This is case sensitive, so the user ‘osxdaily’ would be unidentified while “OSXDaily” will return positive results, thus be sure to use proper casing.

This will produce output looking something like the following, including all login dates, and when possible, the IP source of the connecting machine if the user was logged in through a network connection (in this screenshot example, the origin IP was identified as 192.168.1.4):

If no IP or network origin is shown, this indicates the user is logged in directly on the Mac, either through the standard Mac OS X login process, Fast User Switching, su / sudo, or something similar.

To see who is currently logged in through AFP, you can also use the following last command syntax:

last |grep "logged in"

Users who are actively logged in, whether through a remote connection or the local machine, will show “still logged in” as their status.

A potential hiccup for the ‘last’ command appears when you have users logged in through the SMB / Windows protocol, which is optionally enabled within Mac OS X to allow file sharing between a Windows PC and Macs, and users logged in to the Mac through SMB will not show always how up through the ‘last’ command output. This leaves a few other options, like using ‘netstat’ or, perhaps easier for most users, browsing in Network Activity from the Activity Monitor as was outlined at the beginning of this article.

See Logged In SSH / Telnet Users with ‘who’

Finally, you can see who is currently connected to a Mac through an active SSH connection or the antiquated Telnet protocol by using the classic ‘who’ command from the terminal:

who

This shows all instances of your own user account, as well as logged in users through a connection exterior to the Mac.

Know of another way to see what users are currently logged into a Mac? Share it with us in the comments!