asked on

Windows XP Last Logon Registry Value

Hi,

Is the last logon time for a local \ Domain account stored in the Windows registry? I need to identify the last time an account logged on to a PC - I started by looking at the modification date of the NTUSER.DAT and NTUSER.DAT.LOG files however the modification date appears to have been amended by another process other than logon.

Michael

Brian Pierce

No - but it can be audited - you need to the audit account logon events

On the defualt domain policy (on the DC) go Security Policy -> Security Settings -> Local policies ->Audit policy and enable the auditing of account logon

Barnardos_2LS

ASKER

Is their any way of identifying the last logon locally for accounts prior to auditing being enabled?

dlb6597

download Dumpsec from http://www.somarsoft.com

Barnardos_2LS

ASKER

Ok, maybe it might be easier to explain what i am trying to achieve. What I want to do is implement a startup VBScript to check the last logon time of each profile on a PC, if the time is > 180 days then the VBScript will delete the profile. I have already tried Delprof however this again incorrectly determines the last login time.

johnb6767

Might try and use Last Modified Date of thier profile folder.....

Barnardos_2LS

ASKER

Unfortunately the last modified date of the profile does not accurately reflect whether they have logged on e.g. the last modified date does not change.

dlb6597

download delprof.exe from Microsoft. It will let you delete profiles based on number of days of inactivity

Barnardos_2LS

ASKER

I have already tried Delprof however this again incorrectly determines the last login time.

johnb6767

I just dont think there is anywhere buit in that holds this info......

ASKER CERTIFIED SOLUTION

dlb6597

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Barnardos_2LS

ASKER

Perfect. Thanks for your help.