1

I'm reading over PowerView.ps1, part of PowerSploit, and I'm wondering: what's the difference between sessions and logged on users? Get-NetLoggedon (which uses the NetWkstaUserEnum Win32 API call, and requires local admin rights) always seems to return more results than Get-NetSession (which uses the NetSessionEnum Win32 API call). That's the opposite of what I would expect.

2

A logged on user may have multiple sessions on a network connection - akin to the idea of threads in an application possibly.

In addition, sessions will likely refresh a lot more often than login events. This is especially true of more modern authentication and authorisation methods such as OAuth.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.