Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Last Logged in User

Posted on 2010-09-13
6
Medium Priority
?
435 Views
Last Modified: 2013-11-25
Hi,

How do I find the last logged in user name  in a particular system that is in Domain?
0
Comment
Question by:Seshadrim
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 1

Expert Comment

by:BryanBuckles
ID: 33666924
You should be able to find it in the registery here:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI
String - LastLoggedOnUser = DOMAIN\User.Name

Hope this helps.
0
 

Accepted Solution

by:
Seshadrim earned 0 total points
ID: 33666976
Hi Experts,

I Found the answer and Here it is

Go to the Event Manager-> Security Logs

Sort the Logs by Event ID and Look for ID No: 528 ( Logon / Log off). This Displays the Name of the User Logged in / Logged off.

The latest by Time stamp for this event points the Last user logged in / Logged off.

Note : This will Contains System ID's as well
0
 

Author Comment

by:Seshadrim
ID: 33667008
Hi Bryan

Sorry that I Couldn't Find the registry key Authentication under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion

In the System.

0
Veeam Disaster Recovery in Microsoft Azure

Veeam PN for Microsoft Azure is a FREE solution designed to simplify and automate the setup of a DR site in Microsoft Azure using lightweight software-defined networking. It reduces the complexity of VPN deployments and is designed for businesses of ALL sizes.

 
LVL 1

Expert Comment

by:BryanBuckles
ID: 33667126
Sorry that didnt help.  Glad you were able to find it though.
0
 
LVL 21

Expert Comment

by:snusgubben
ID: 33670932
Just to fill in, if you have multiple DCs it will only be logged on the DC that did the authentication. It will not replicate this information with other DCs.

To be 100 per cents certain, you should check the log on every DC and check find the latest timestamp.

Tools like EventCombMT is helpful in cases like this.

http://www.microsoft.com/downloads/en/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en
0
 

Author Closing Comment

by:Seshadrim
ID: 33999713
This Works
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
Introduction to Processes
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

609 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question