Рекомендую посмотреть у SysInternals.
Навскидку:
LogonSessions v1.1
If you think that when you logon to a system there's only one active logon session, this utility will surprise you. It lists the currently active logon sessions and, if you specify the -p option, the processes running in each session. LogonSessions works on Windows 2000 and higher.
Usage: logonsessions [-p]
