How to Determine Last Logon date in Workgroup Terminal Servers

take a look at event manager (right click on my computer)

Thank you.

Is Event manager the same as the Event Viewer?   I could not locate the Event manager by right clicking on my computer, but could find event viewer in the administration tools.

This was a good idea. The windows 2003 security event logs can export to a csv format file   The csv file is in a good format to be searched.  The Windows 2000 security event viewer is not so helpful.   Its format can not be easily modified so it can be searched.

Well, we are 1/2 way there. I still need a script or procedures to look up the last login date.

yes it is event viewer. sorry my mistake. i am unix/linux user so i do not know exact names.

and to scripting: i do not know how to do this on windows, but you can open csv on excel or something and there you can write a formula for sorting data.

You may want to check out Microsoft's LogParser which allows querying/reporting of information from event logs and formatted files.

Download from http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en and install on computer(s)

Start a command prompt via Start | All Programs | Log Parser 2.2 | Log Parser 2.2 (path on XP)

at log parser command prompt (not tested yet since don't have security events on my home machine):

C:\Program Files\Log Parser 2.2> logparser "SELECT MAX(TimeGenerated), SID FROM Security WHERE EventID = 528 GROUP BY SID ORDER BY MAX(TimeGenerated)" i:EVT resolveSIDs:ON

Looks like the dashes ended up as special characters in previous post, attached code to hopefully correct.

C:\Program Files\Log Parser 2.2> logparser "SELECT MAX(TimeGenerated), SID FROM Security WHERE EventID = 528 GROUP BY SID ORDER BY MAX(TimeGenerated)" -i:EVT -resolveSIDs:ON

Select allOpen in new window

I found a better solution that my previous suggestion which requires that the security event log be present and contain all events from when started.  Copy the script from http://www.themssforum.com/VBscripts/Last-logon-190039 and save as LastLogon.vbs, then run from a command line like so:

C:\Work> cscript LastLogon.vbs

and will give output like (if you don't use cscript you will get a dialog popup for every account):

Administrator, 9/9/2007 6:53:23 AM
ASPNET, 6/30/2006 9:18:21 PM
SQLDebugger, <never>

Thanks for the link. I waited too long and they have removed the script from the site.

Bummer

Mega Thanks