search
top

How To Retrieve the Last Login Time For a User on Windows Using Net User

Introduction

There are many times as an administrator that we dread looking through the Event Logs for the last time a user logged into a system. Command line is always a great alternative. Using the net user command we can do just that.

Process

The syntax of the command is given below. Do not forget the double quotes around Last logon.

net user username | findstr /B /C:"Last logon"

Example:
To find the last login time of the computer administrator or a local account on the system.

C:\> net user administrator | findstr /B /C:"Last logon"
 Last logon 8/20/2012 9:25:18 AM

Example:
For a domain user, the command is the same as for a local user but we add the /domain switch.

C:\>net user mark /domain | findstr /B /C:"Last logon"
 Last logon 5/3/2016 9:16:16 AM

Conclusion

With a simple use of the net user command we have saved ourselves alot of time combing through the event viewer log.

Leave a Reply

Your email address will not be published. Required fields are marked *

top