Func<DirectoryEntry, bool> IsActive = de => de.NativeGuid == null ? false : !Convert.ToBoolean((int)de.Properties["useraccountcontrol"].Value & 0x0002);

            using (var context = new PrincipalContext(ContextType.Domain))
            {
                using (var searcher = new PrincipalSearcher(new UserPrincipal(context)))
                {
                    foreach (var result in searcher.FindAll())
                    {
                        using (var de = result.GetUnderlyingObject() as DirectoryEntry)
                        {
                            if(IsActive(de))
                            {
                                Console.WriteLine("{0} - {1}", result.DisplayName, result.SamAccountName);
                                i++;
                            }
                        }
                    }
                }
            }            
            Console.ReadLine();

        static void Main(string[] args)
        {
            string serverName = Environment.MachineName;    // my machine name
            foreach (var user in GetLoggedUser(serverName))
            {
                Console.WriteLine("{0} - {1}", serverName, user);
            }
            Console.Read();
        }

        private static IEnumerable<string> GetLoggedUser(string machineName)
        {   
            var scope = GetManagementScope(machineName);
            scope.Options.Timeout = TimeSpan.FromMinutes(1);
            scope.Connect();

            // Interactive (2) : Intended for users who are interactively using the machine, 
            // such as a user being logged on by a terminal server, remote shell, or similar process.
            var Query = new SelectQuery("SELECT LogonId FROM Win32_LogonSession Where LogonType = 2");
            var Searcher = new ManagementObjectSearcher(scope, Query);
            var regName = new System.Text.RegularExpressions.Regex(@"(?<=Name="").*(?="")");

            foreach (ManagementObject WmiObject in Searcher.Get())
            {
                foreach (ManagementObject LWmiObject in WmiObject.GetRelationships("Win32_LoggedOnUser"))
                {
                    yield return regName.Match(LWmiObject["Antecedent"].ToString()).Value;
                }
            }
        }

        private static ManagementScope GetManagementScope(string machineName)
        {
            ManagementScope Scope;

            if (machineName.Equals("localhost", StringComparison.OrdinalIgnoreCase))
                Scope = new ManagementScope(String.Format("\\\\{0}\\root\\CIMV2", "."), GetConnectionOptions());
            else
            {
                Scope = new ManagementScope(String.Format("\\\\{0}\\root\\CIMV2", machineName), GetConnectionOptions());
            }
            return Scope;
        }

        private static ConnectionOptions GetConnectionOptions()
        {
            return new ConnectionOptions
            {
                EnablePrivileges = true,
                Authentication = AuthenticationLevel.PacketPrivacy,
                Impersonation = ImpersonationLevel.Impersonate,
            };
        }

            string machineName = Environment.MachineName,,
                   location = @"SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI";
            var registryView = Environment.Is64BitOperatingSystem ? RegistryView.Registry64 : RegistryView.Registry32;
            using (var hive = RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, machineName, registryView))
            {
                using (var key = hive.OpenSubKey(location))
                {
                    var item = key.GetValue("LastLoggedOnUser");
                    string itemValue = item == null ? "No Logon Found" : item.ToString();
                    Console.WriteLine(itemValue);
                }
            }
            Console.Read();

            string logType = "Application",
                   machineName = System.Environment.MachineName;

            EventLog ev = new EventLog(logType, machineName);
            int LastLogToShow = ev.Entries.Count;
            if (LastLogToShow <= 0)
                Console.WriteLine("No Event Logs in the Log :" + logType);
            // Read the last 2 records in the specified log. 

            foreach (var lg in ev.Entries.Cast<EventLogEntry>())          //  Необходимо найти события 4634 и 4624 => .Where(x => x.EventID == 4634)
            {
                Console.WriteLine("Event ID : " + lg.EventID);
                Console.WriteLine("Entry Type : " + lg.EntryType.ToString());
                Console.WriteLine("Message :  " + lg.Message + "\n");
            }
            ev.Close();
            Console.Read();