Using ‘Net user’ command we can find the last login time of a user. The exact command is given below.
net user username | findstr /B /C:"Last logon"
Example:
To find the last login time of the computer administrator
C:\> net user administrator | findstr /B /C:"Last logon" Last logon 6/30/2010 10:02 AM C:>
For a domain user, the command would be as below.
C:\>net user john /domain | findstr /C:"Last logon" Last logon 9/18/2013 10:18:41 AM
How to find the last user logged into the machine?
IS there any way to find this from command line?
Import-Module ActiveDirectory
function Get-ADUserLastLogon([string]$userName)
{
$dcs = Get-ADDomainController -Filter {Name -like “*”}
$time = 0
foreach($dc in $dcs)
{
$hostname = $dc.HostName
$user = Get-ADUser $userName | Get-ADObject -Properties lastLogon
if($user.LastLogon -gt $time)
{
$time = $user.LastLogon
}
}
$dt = [DateTime]::FromFileTime($time)
Write-Host $username “last logged on at:” $dt }
Get-ADUserLastLogon -UserName XXXXX
I think from event log we can find the last logged in user name. I do not know of any way to know this from command line.
I run CMD with Admin right. But I receive MSG: “FINDSTR: Can not open logon”?
May you explain me?
Thank you.
I think you have executed something like below
net user administrator | findstr /B /C:Last logon
You may have missed double quotes around ‘Last Logon’. Run the command “net user administrator | findstr /B /C:”Last logon”. It would print the last login time.
what command to use if we want to see last 5 logons ??
You can also see it by typing this in cmd (Command Prompt):
net user(press enter key)
then again type
net user xxx
xxx- name of username you obtained from first command of net user
I think net user xxx will only show the last time the user “logged on”, which will not be reflected in a restart of Windows if you have the account set to not require a password logon initially. This date and time will only be accurate if the user had to actually put in a password and “log on”.
I think a better alternative is
quser xxx
This will show the date and time the user account logged on, and will reflect any restart of Windows that bypassed the login process.
C:>quser Jeffrey
USERNAME SESSIONNAME ID STATE IDLE TIME LOGON TIME
>jeffrey console 2 Active none 1/16/2016 11:20 AM
quser worked perfectly!! I was having trouble with “net user” on my work computer because of how the network is configured (I don’t have admin rights) but quser worked!
How can I use this to show more than one value. In example if may wanted to show User name and Password last set. Thanks!
Is there a way to run this command on an OU in AD so that I could export a list of users in said OU with their last log on dates?
‘net’ is not recognized as an internal or extarnal command,operable program or batch file
this is occur what can i do for it..
Is there a way in CMD to get last 3~6 user logon with date & time or duration & save it in text file. I have a hard time to find a culprit student who love to sabotage my labs keyboard button.
QUser cblackburn was what I needed thank you. Is there a different command that will show me the last time I locked or unlocked the machine which would still be more recent. I know this is in the event viewer, but it’s a mess.
Works perfectly for local users on Server 2008 R2
what command to use if we want to see last 10 logons ??
How can one find the last time a user logged into a machine?
IS there any way to find this from command line?
kumar’s answer does not work for A user, on A machine. It provides when the user logged into some computer on the domain.
This only works for local accounts.
Did you try the /DOMAIN switch after the logon name?
which command ?? to see which last user has used the following machine xxx.
this needs to be updated for Windows 10, since users often logon with PIN or face. There should be another different cmd to display the last “logon” from that. People don’t typically logon with a password any more. It’s mostly with PIN or face.
For 1809 and upper builds this solution not work 100%
CMD was return nothing.
How can change the cmd to obtain this for all local users at once.
So I would not have to retype this cmd for every single user.
SETLOCAL EnableDelayedExpansion
FOR /D %%A in (“c:\Users\*”) DO (
set “userProfile=%%~nxA”
net user !userProfile! /domain | findstr /C:”Last logon”
)
Find won’t work if the output is localized
net user john /domain | findstr /C:”Last logon”
This may not give a logon date if you have multiple domain controllers. For example newer domain controllers may not have a logon date for a user.