How to monitor User for WMI Win32_NTLogEvent ?

With IPHost Network Monitor you can run WMI User monitoring of various devices in your network.

To create a WMI monitor for User, provide host name (it must be a Windows host) and specify custom WQL query:

SELECT User FROM Win32_NTLogEvent

The user name of the logged on user when the event ocurred. If the user name cannot be determined this will be NULL

This class is used to translate instances from the NT Eventlog.

IPHost Network Monitor is an advanced and easy tool for monitoring LAN and WAN networks, network servers, workstations and TCP/IP devices. Use IPHost Network Monitor to monitor your servers, domains, computers and devices.