You have to define "current". When the user is not doing anything (or just
went off and left the machine running with it logged in) there is no
traffic, therefore there isn't anything "current" to measure unless they
have a document open on their screen that is a file from a fileserver, in
which case just that one single file would be "in use".
Normally after a user first logs in, you could unplug thier network cable
and they would never notice the difference until they tried to open a file
on the network or tried to go to the Internet.
It isn't like the old days of client-server mainframes with "dumb terminals"
that maintain a constant live connection to the server, or run some terminal
emulation. Windows Terminal Services would be the closest modern form of
that and I'm sure the Terminal Servce Manager will show the current active
TS Users.
