search
top

How To Retrieve the Last Login Time For a User on Windows Using Net User

Introduction

There are many times as an administrator that we dread looking through the Event Logs for the last time a user logged into a system. Command line is always a great alternative. Using the net user command we can do just that.

Process

The syntax of the command is given below. Do not forget the double quotes around Last logon.

net user username | findstr /B /C:"Last logon"

Example:
To find the last login time of the computer administrator or a local account on the system.

C:\> net user administrator | findstr /B /C:"Last logon"
 Last logon 8/20/2012 9:25:18 AM

Example:
For a domain user, the command is the same as for a local user but we add the /domain switch.

C:\>net user mark /domain | findstr /B /C:"Last logon"
 Last logon 5/3/2016 9:16:16 AM

Conclusion

With a simple use of the net user command we have saved ourselves alot of time combing through the event viewer log.

6 Responses to “How To Retrieve the Last Login Time For a User on Windows Using Net User”

  1. Andre says:

    On several accounts I get

    Last logon Never

    despite the fact that they are used regularly.

    Any thoughts?

  2. arkmay says:

    Could be they have an ID to attach to a resource, but dont actually log on.

    • newlife007 says:

      If they are attaching to a resource on the system it will authenticate and will show. Log Event 4624 will Identifies the account that requested the logon – NOT the user who just logged on. Subject is usually Null or one of the Service principals and not usually useful information. See New Logon for who just logged on to the system.

  3. mp says:

    I would like to see the last logon for all users not just one by one .. what is the command I should use.
    Kindly assist, plsss …
    Thanks

    • newlife007 says:

      Try this one liner in PowerShell.

      $([ADSI]”WinNT://$env:COMPUTERNAME”).Children | where {$_.SchemaClassName -eq ‘user’} | ft name,lastlogin

    • newlife007 says:

      Found a better PowerShell way. It get all accounts, just change the Max Entries to expand it.

      Get-WinEvent -FilterHashtable @{logname=’Security’;id=4672} -MaxEvents 5 | Select-Object -Property timecreated, @{N=’User’;E={$_.Properties[1].Value}}

Trackbacks/Pingbacks

  1. Tid-bits | Kabir's blog for Windows System Administration - […] http://lifeofageekadmin.com/retrieve-last-login-time-user-windows-using-net-user/  […]
  2. windows last login time - GeeksForJobs - […] 5. How To Retrieve the Last Login Time For a User on Windows … […]

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

top