Hi Peng,
T-code SM04 is used to view the current system User List.
It displays the terminal details, t-code, no. of sessions, connection type and the usage details.
If you go to that t-code you will see that for the connection type RFC the terminal is an IP address which means they are connected through an Remote connection / VPN. For the connection type GUI you will notice the field consists of either the user name or the computer number.
Security uses this t-code to track their users, how they are getting connected during work hours and what is the system usage.
Hope that answers your question