Get Machine Logon Users

6 min

description retrieve a list of users who have logged onto a specific machine by using the machine id in microsoft defender endpoint url /api/machines/{{id}}/logonusers method get inputs path parameters (object) – required id (string) – required output example \[ { "status code" 200, "response headers" { "date" "thu, 04 may 2023 17 56 11 gmt", "content type" "application/json; odata metadata=minimal; odata streaming=true; charset=utf 8", "transfer encoding" "chunked", "connection" "keep alive", "content encoding" "deflate", "vary" "accept encoding", "odata version" "4 0", "strict transport security" "max age=15724800; includesubdomains" }, "reason" "ok", "json body" { "@odata context" "https //api securitycenter microsoft com/api/$metadata#users", "value" \[ { "id" "se pov desktop\\\chris phillips", "accountname" "chris phillips", "accountdomain" "se pov desktop", "accountsid" null, "firstseen" "2023 04 26t15 03 14z", "lastseen" "2023 04 26t15 03 14z", "mostprevalentmachineid" null, "leastprevalentmachineid" null, "logontypes" "interactive", "logonmachinescount" null, "isdomainadmin" true, "isonlynetworkuser" null } ] } } ] output parameters status code (number) reason (string) json body (object) @odata context (string) value (array) id (string) accountname (string) accountdomain (string) accountsid (object) firstseen (string) lastseen (string) mostprevalentmachineid (object) leastprevalentmachineid (object) logontypes (string) logonmachinescount (object) isdomainadmin (boolean) isonlynetworkuser (object) response headers header type date string content type string transfer encoding string connection string content encoding string vary string odata version string strict transport security string