Enumerate Logged-On Users with the Workstation Service

You need at least local admin privilege on the remote target, use option --local-auth if your user is a local account

To enumerate logged on users on a remote target, the following option can be used:

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --loggedon-users

Note that if a username is returned, you will be able to impersonate that user's primary token to run commands on its behalf.

In case you want to hunt a specific user, you can specify its username the following way:

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --loggedon-users username