Last Logged in User


How do I find the last logged in user name  in a particular system that is in Domain?
Who is Participating?
SeshadrimAuthor Commented:
Hi Experts,

I Found the answer and Here it is

Go to the Event Manager-> Security Logs

Sort the Logs by Event ID and Look for ID No: 528 ( Logon / Log off). This Displays the Name of the User Logged in / Logged off.

The latest by Time stamp for this event points the Last user logged in / Logged off.

Note : This will Contains System ID's as well
You should be able to find it in the registery here:

String - LastLoggedOnUser = DOMAIN\User.Name

Hope this helps.
SeshadrimAuthor Commented:
Hi Bryan

Sorry that I Couldn't Find the registry key Authentication under


In the System.

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Sorry that didnt help.  Glad you were able to find it though.
Just to fill in, if you have multiple DCs it will only be logged on the DC that did the authentication. It will not replicate this information with other DCs.

To be 100 per cents certain, you should check the log on every DC and check find the latest timestamp.

Tools like EventCombMT is helpful in cases like this.
SeshadrimAuthor Commented:
This Works
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.