Sean Wallbridge
What
First off a disclaimer. In a production SharePoint environment, of course you shouldn’t perform an IISRESET/system reset when users are connected. Buuuuutttttt, in those instances where you are in a jam, or the system is in testing or you’re feeling brazen, I’m just saying you “coullldddd” consider the following… 
I was working with a client the other day and we had a SharePoint farm that was heavily neglected and in need of an IISRESET at a minimum to push some stuff through so we could continue on to further work/troubleshooting. We knew the system was going to be lightly used that day and the “suggestion” was that we could peak and see if anyone was connected and if not, we could blast out a quick IISRESET (and nobody would notice right? Or maybe we’d just blame it on the network. (I joke of course…)
So this isn’t how to do an IISRESET with IIS and SharePoint. Nor is this how to do a “Warmup” of SharePoint to ensure after said IISRESET, that SharePoint is as quick/functional and ready to serve users as possible… This is about how to quickly check, on your Web Server (WFE/Front End, the one DNS for your SharePoint Web Applications is pointed at) to see if there are any active HTTP or HTTPS connections in place (users having a chat with your SharePoint Server).
So What
We just rely on good ole “NETSTAT” that has been in Windows almost as long as I have. Your mileage will vary (newer versions of Windows Server support the -an switch, older versions won’t so in those cases, simply not include it) and then pipe the port we are looking for (80 for http, 443 for https, or perhaps a custom port you have defined for your web app … but why would you do that … really?)
Now What
The following is the output at this moment in time, from our Front-End SharePoint 2013 Server running on Windows Server 2012, all of our key web apps are using HTTPS so we are looking for ports with “443” (the SSL native port):
NETSTAT -an | findstr 443
And here’s the result. By my count, there are 10 people connected (sounds about right, we all use SharePoint, all the time)… So if I were to try and sneak in an IISRESET, I would need to negotiate with these folks first (well not really, I own the server so I suppose I could pull rank ;).
But shhhhh, don’t tell anyone, okay?
How could you tell which of those were users. I see you marked them with a blue asterisk but can’t tell what you are seeing that tells ten of these results were users.
Hey CJ,
Each one of those highlighted is a unique source IP address on our LAN. I.e .26, .29, .36, .159, etc.