How to See What Users Are Connected & Logged In To a Mac

Mar 25, 2014 - 13 Comments

List user log ins to Mac OS X

If you share your Mac on a network you may be interested to know who is connected to the Mac at any given time. This may include listing currently logged in users through a variety of network protocols, even locally, or perhaps just a history of users logins over a period of time. While Mac OS X Client doesn’t offer the same level of information as Mac OS X Server, you can still find user connection details by using a variety of tools built into all versions of Mac OS X.

We’ll cover finding active user accounts through Activity Monitor, the ‘last’ command, and the ‘who’ command. This is fairly comprehensive, meaning it will include all users who are currently connected and/or actively logged onto a Mac, whether by another user account in the background, a Guest user account, general sharing from public folder access, a user connected through a local network share for the purpose of sharing files with another Mac, network users connected from Windows PC’s or linux machines through SMB, remote logins through SSH and SFTP, just about everything.

See Users with Activity Monitor in Mac OS X

The simplest way to get basic user details is to use Activity Monitor from an Administrator user account. This will be inclusive, but the data is a bit limited for some uses as you’ll see:

  • Launch “Activity Monitor” in Mac OS X, found within /Applications/Utilities/
  • Click on “Users” to sort and group the list by users logged in

Active Network users in Mac OS X Activity Monitor

If you’re looking for a specific user account, you can easily find that user as well as all the processes they are running, be it apps, services, or nothing, and what kind of resources they are using. Choosing the “Network” tab within Activity Monitor will offer details about user network usage as well, helping to indicate if they are copying or receiving files from the Mac to their own.

To properly make use of this information, you’ll want some basic understanding of what user accounts exist on the Mac (i.e. who is found in the /Users/ folder), but also understand the root / superuser account, in addition to services and daemon agents running in the background on all Macs, which may show up in the Users list with names like spotlight, netbios, usbmuxd, locationd, coreaudiod, window server, mdnsresponder, networkd, appleevents, amongst many others.

Ultimately, the ‘last’ command may prove more useful for those comfortable with the command line.

List Connected Users & Log Ins to the Mac with “last”

The command line tool ‘last’ offers a simple way to see a history of what users have logged into a given Mac, both locally and also through a network connection like AFP, the default sharing protocol for Macs. Using ‘last’ is simple enough, but you should have some familiarity with the command line to get the most use out of the utility and to comprehend the output.

Launch Terminal app, found with in /Applications/Utilities/ and enter the following command string to see a full list of user logins


To search for a specific user login, send the output of last through grep like so:

last |grep USERNAME

For example, to search last output for the user “OSXDaily” you would use the following command:

last |grep OSXDaily

This is case sensitive, so the user ‘osxdaily’ would be unidentified while “OSXDaily” will return positive results, thus be sure to use proper casing.

This will produce output looking something like the following, including all login dates, and when possible, the IP source of the connecting machine if the user was logged in through a network connection (in this screenshot example, the origin IP was identified as

List of users connected to a Mac

If no IP or network origin is shown, this indicates the user is logged in directly on the Mac, either through the standard Mac OS X login process, Fast User Switching, su / sudo, or something similar.

To see who is currently logged in through AFP, you can also use the following last command syntax:

last |grep "logged in"

Users who are actively logged in, whether through a remote connection or the local machine, will show “still logged in” as their status.

A potential hiccup for the ‘last’ command appears when you have users logged in through the SMB / Windows protocol, which is optionally enabled within Mac OS X to allow file sharing between a Windows PC and Macs, and users logged in to the Mac through SMB will not show always how up through the ‘last’ command output. This leaves a few other options, like using ‘netstat’ or, perhaps easier for most users, browsing in Network Activity from the Activity Monitor as was outlined at the beginning of this article.

See Logged In SSH / Telnet Users with ‘who’

Finally, you can see who is currently connected to a Mac through an active SSH connection or the antiquated Telnet protocol by using the classic ‘who’ command from the terminal:


This shows all instances of your own user account, as well as logged in users through a connection exterior to the Mac.

See what users are connected to a Mac

Know of another way to see what users are currently logged into a Mac? Share it with us in the comments!


Related articles:

Posted by: Paul Horowitz in Mac OS, Tips & Tricks


» Comments RSS Feed

  1. Monyker says:

    Or if you’re in a funny mood:

    alias stinkeye=finger

    Then you can do:



  2. Monyker says:

    How about:




  3. Tibs says:

    OK so I dod netstat -na |grep 139
    and got back
    tcp4 0 0 ESTABLISHED

    This worries me. How do I go about disconnecting the established connection? HELP!

  4. Michelle says:

    Is there a way to delete the list of logged in users from the “last” command?

  5. adnan says:

    Dear Sir,

    we are using MAC staitons in our network. there is station on which user will copy data. there are 15 users who need to copy data from this station. but currently we can only connect 5-6 user at a time.

    kindly guide me, how to connect 15 users at a time to MAC station.


    Muhammad Adnan Qadir

  6. Fischmuetze says:

    The command “w” is the quicker way to display who is logged in and what they are doing

    • Zell says:

      DAMN it !

      “w” command is already more powerful than “who” ! I’m going to take a look at the man page !
      Thanks for the tips !

    • Neal says:

      +1 Septillion for w. who on mac is lacking horribly, but w has the details you need.

    • petra says:

      When I did the “w” it came back with this: does this mean someone other than myself is logged in?

      11:38 up 56 mins, 2 users, load averages: (—–same IP address)
      Leslie console – 10:54 44 –
      Leslie s000 – 11:26 – w
      iMac:~ Leslie$

  7. Georg Rabensteiner says:

    wow… pretty nice tips! THX!

  8. Ta0 says:

    You can also use netstat to find the connections through AFP and SMB

    For AFP (Mac to Mac)

    netstat -na | grep 548


    netstat -na | grep 427

    and for Samba (Mac to PC)

    netstat -na |grep 445


    netstat -na |grep 139

    • Albert25 says:

      To restrict the output to only show SMB connections from other clients to this server:

      netstat -na | awk ‘$4 ~ /[0-9]\.(139|445)$/ {print $0}’

      To include AFP, you can add it’s ports to the awk regex.

      But there should really be a better way, like “smbstatus” on Linux. Too bad Apple replaced Samba with their own smb stuff…

  9. Geoff Winters says:

    Very thorough as usual, love the info thanks guys!

    Now, I wish you could just see a simple list of “Connected Users” in the “Sharing” control panel, is that so hard to ask of Apple?

Leave a Reply


Shop on and help support OSXDaily!

Subscribe to OSXDaily

Subscribe to RSS Subscribe to Twitter Feed Follow on Facebook Subscribe to eMail Updates

Tips & Tricks


iPhone / iPad



Shop on Amazon to help support this site