how to view the most logged in user on Mac OS X

Sometimes it is extremely useful to see who the most logged in user is on a Mac, especially when using management tools such as JAMF’s Casper. JAMF’s built-in recon command does allow the administrator to populate a username field with the currently logged in user, but this may not be the most logged in user, and can generate false positives, false negatives, inaccurate inventory and user reports, and a host of other confusing anomalies. Use one of the below two commands to capture the most logged in user on a mac.

last | cut -f 1 -d ' ' | sort | uniq -c | sort -nr | grep -v reboot | grep -v shutdown | awk '{print $2, $5;}' | awk '{print $0 ; exit(0); }'
ac -p | sort -nk 2 | grep -v reboot | grep -v shutdown | awk '/total/{print x};{x=$1}'

I prefer to use the “ac” command as it takes into account connection times. Often times my company has several different users logging in to the same mac as is the case with freelance stations. However one of the users may log in for long periods of time to do work, and since we can only assign a machine to one user, why not make this assignment based on who uses the Mac the longest? I’ve written a short script for use as a login policy in JAMF to populate the username field with most logged in user.

MostLoggedInUser=`ac -p | sort -nk 2 | grep -v reboot | grep -v shutdown | awk '/total/{print x};{x=$1}'`
jamf recon -skipApps -skipFonts -skipPlugins -endUsername $MostLoggedInUser

I like to grep out (grep -v) the reboot and shutdown users, since OS X creates these automatically for reboot and shutdown operations and it is conceivable that an end user could log in an equal number of times as either one of these system users.

About this entry