ใช้ Powershell

User Login
Get-CimInstance Win32_LoggedOnUser | Select Antecedent, Dependent

User Login Process
Get-Process -IncludeUserName | Select-Object Id, ProcessName, UserName

User Login Service
Get-WmiObject Win32_Service | Select Name, StartName, State