1

I'm reading over PowerView.ps1, part of PowerSploit, and I'm wondering: what's the difference between sessions and logged on users? Get-NetLoggedon (which uses the NetWkstaUserEnum Win32 API call, and requires local admin rights) always seems to return more results than Get-NetSession (which uses the NetSessionEnum Win32 API call). That's the opposite of what I would expect.

Improve this question

1 Answer 1

Reset to default
2

A logged on user may have multiple sessions on a network connection - akin to the idea of threads in an application possibly.

In addition, sessions will likely refresh a lot more often than login events. This is especially true of more modern authentication and authorisation methods such as OAuth.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .