Determining the last computer an account logged into

Posted on 2004-11-04
Last Modified: 2012-05-05
Here's a somewhat interesting problem I hope someone might have an easy solution too:

We have the standard of naming computers after their users (where possible), which makes it easy to group them in departmental OU's and such. Recently at my work there has been some high turnover, and techs have been somewhat lax in renaming computers to reflect the actual person that is using the machine. For example, you might have a machine named "juserxp", even though Joe User quit 3 months ago, and now Sally Snide is now using the machine.

Using the usrstat.exe program in the Resource Kit, I can of course determine the last login of a particular user, but so far have not found a way to determine which machine the user logged into. Security Event Log would reveal this information I imagine, and if I have too I thought about writing a login script that writes the machine name to a text file somewhere at login, but I'm looking for a more "on the fly" solution. A script or tool that could be run at my console command prompt perhaps.

Longshot I suppose, but if anyone has any ideas I would appreciate it.
Question by:mvogts
    LVL 76

    Accepted Solution

    Other than the solutions you've already mentioned I don't know of any better way to determine who was last logged on to a given computer.  If you'd like to know who is currently logged on to a given computer, then the script below will tell you that.  It uses WMI (Windows Management Instrumentation) to determine that.  All you need to do to make use of the script is change strComputer to the name of the computer you want to check.  A more advanced version of the script would be to create an array of computer names to check and have the script check them all in sequence.

    On Error Resume Next
    strComputer = "."
    Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48)
    For Each objItem in colItems
        Wscript.Echo "Computer Name: " & objItem.Name
        Wscript.Echo "UserName: " & objItem.UserName

    Author Comment

    Not exactly what I was looking for, but that script will be useful, and it looks like this question is sort of tapped out, so points awarded.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    6 Surprising Benefits of Threat Intelligence

    All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

    NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
    This paper addresses the security of Sennheiser DECT Contact Center and Office (CC&O) headsets. It describes the DECT security chain comprised of “Pairing”, “Per Call Authentication” and “Encryption”, which are all part of the standard DECT protocol.
    This video is in connection to the article "The case of a missing mobile phone (". It will help one to understand clearly the steps to track a lost android phone.
    This video discusses moving either the default database or any database to a new volume.

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now