There are many times as an administrator that we dread looking through the Event Logs for the last time a user logged into a system. Command line is always a great alternative. Using the net user command we can do just that.
The syntax of the command is given below. Do not forget the double quotes around Last logon.
net user username | findstr /B /C:"Last logon"
To find the last login time of the computer administrator or a local account on the system.
C:\> net user administrator | findstr /B /C:"Last logon" Last logon 8/20/2012 9:25:18 AM
For a domain user, the command is the same as for a local user but we add the /domain switch.
C:\>net user mark /domain | findstr /B /C:"Last logon" Last logon 5/3/2016 9:16:16 AM
With a simple use of the net user command we have saved ourselves alot of time combing through the event viewer log.