How to Get Current User in PowerShell

1. Use the Win32_ComputerSystem Class to Get Current User in PowerShell
2. Use Environment Variables to Get Current User in PowerShell
3. Use the whoami Command to Get Current User in PowerShell

When working with Windows, you’ll almost certainly need to know which user accounts are actively signed in to a computer at some time. Thankfully, PowerShell can get current users on remote or local machines.

There are many methods to retrieve current users signed on to a machine without using PowerShell. Using PowerShell, you can also alter the results by treating them as objects.

For example, if you execute a script asking for user credentials, PowerShell can dynamically generate the username, leaving you with only the password to enter manually.

Use the Win32_ComputerSystem Class to Get Current User in PowerShell

We will use PowerShell cmdlets, namely Get-CimInstance and Get-WMIObject. These allow us to get the current user by using WMI (Windows Management Instrumentation) class on remote or local computers. Invoke any of the following cmdlets addressing the Win32 ComputerSystem class in PowerShell to get the current user.

The Username property is one of the attributes of the Win32 ComputerSystem class. To do so, launch PowerShell and perform the commands shown below.

Get-CimInstance:

(Get-CimInstance -ClassName Win32_ComputerSystem).Username

Get-WMIObject:

(Get-WMIObject -ClassName Win32_ComputerSystem).Username

Output:

DESKTOP-DelftStack\DefltStack

Here both commands get the same result. However, it should be noted that the above commands only give results when if the user is directly logged in. If it is a remote log-in, the username will be blank.

Use Environment Variables to Get Current User in PowerShell

Another technique to get the current user on a machine using PowerShell is to retrieve information from environment variables. The OS data, such as the current user’s username, is represented by the environment variables. However, there are mainly three ways to work with environment variables; it gets the same results whatever the method.

The three ways are below.

1. Env PowerShell Drive
2. $env Variable
3. .NET Environment Class

The above methods are further explained below.

Env PowerShell Drive

Environment variables are cached by PowerShell and made available through the Env: drive, which is a PowerShell Drive (PSDrive). PSDrives are storage locations that may be accessed like a drive on a computer (for example, C:), but exclusively via PowerShell.

The Env: drive is automatically created when you start a PowerShell session. Because Env: is a drive, you may access its contents using the Get-ChildItem cmdlet, which works similarly to listing the items of a file system folder or drive.

The user can be retrieved using the following command.

Get-ChildItem Env:\USERNAME

Output

Name                           Value
----                           -----
USERNAME                       DelftStack

In order to get the value only, the following command can be used.

(Get-ChildItem Env:\USERNAME).Value

Output:

DelftStack

It can be seen the command returns the username value as a string.

$env Variable

Another way is to treat the env drive as a variable in which you can use the following commands below:

$env:username

Output:

DelftStack

.NET Environment Class

The Environment class does have a Username field, which has the same value as the $env variable: the present user’s username. Execute the PowerShell command below to obtain the value of the username field.

[System.Environment]::UserName

Output:

DelftStack

.NET WindowsIdentity Class

Another class to execute to get the current user in windows is WindowsIdentity class. It has the GetCurrentname method, which can be used as shown below.

([System.Security.Principal.WindowsIdentity]::GetCurrent().Name).Split('\')[1]

Output:

DelftStack

Use the whoami Command to Get Current User in PowerShell

The whoami command is an executable file that resides in the %WINDIR%\System32 folder, and the name of the file is whoami.exe. When we run the below command, it results in the username in domain/username format.

whoami

Output:

DESKTOP-DelftStack\DefltStack