May 8, 2016 Posted by newlife007 on May 8, 2016 in Windows | 6 comments

How To Retrieve the Last Login Time For a User on Windows Using Net User

Introduction

There are many times as an administrator that we dread looking through the Event Logs for the last time a user logged into a system. Command line is always a great alternative. Using the net user command we can do just that.

Process

The syntax of the command is given below. Do not forget the double quotes around Last logon.

net user username | findstr /B /C:"Last logon"

Example:
To find the last login time of the computer administrator or a local account on the system.

C:\> net user administrator | findstr /B /C:"Last logon"
 Last logon 8/20/2012 9:25:18 AM

Example:
For a domain user, the command is the same as for a local user but we add the /domain switch.

C:\>net user mark /domain | findstr /B /C:"Last logon"
 Last logon 5/3/2016 9:16:16 AM

Conclusion

With a simple use of the net user command we have saved ourselves alot of time combing through the event viewer log.

6 Responses to “How To Retrieve the Last Login Time For a User on Windows Using Net User”

1. Andre says:

   March 7, 2017 at 4:58 pm

   On several accounts I get

   Last logon Never

   despite the fact that they are used regularly.

   Any thoughts?

   Reply
2. arkmay says:

   March 20, 2017 at 8:03 pm

   Could be they have an ID to attach to a resource, but dont actually log on.

   Reply
   • newlife007 says:

     March 21, 2017 at 10:42 am

     If they are attaching to a resource on the system it will authenticate and will show. Log Event 4624 will Identifies the account that requested the logon – NOT the user who just logged on. Subject is usually Null or one of the Service principals and not usually useful information. See New Logon for who just logged on to the system.

     Reply
3. mp says:

   March 28, 2017 at 4:39 am

   I would like to see the last logon for all users not just one by one .. what is the command I should use.
   Kindly assist, plsss …
   Thanks

   Reply
   • newlife007 says:

     March 28, 2017 at 11:50 am

     Try this one liner in PowerShell.

     $([ADSI]”WinNT://$env:COMPUTERNAME”).Children | where {$_.SchemaClassName -eq ‘user’} | ft name,lastlogin

     Reply
   • newlife007 says:

     March 28, 2017 at 6:30 pm

     Found a better PowerShell way. It get all accounts, just change the Max Entries to expand it.

     Get-WinEvent -FilterHashtable @{logname=’Security’;id=4672} -MaxEvents 5 | Select-Object -Property timecreated, @{N=’User’;E={$_.Properties[1].Value}}

     Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.