Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies. Only from Platform Scholar.
COURSE of the MONTH
9 days, 9 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Last Logged in User
Posted on 2010-09-13
Hi,
How do I find the last logged in user name in a particular system that is in Domain?
How do I find the last logged in user name in a particular system that is in Domain?
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
3
2
6 Comments
You should be able to find it in the registery here:
HKEY_LOCAL_MACHINE\SOFTWAR
String - LastLoggedOnUser = DOMAIN\User.Name
Hope this helps.
HKEY_LOCAL_MACHINE\SOFTWAR
String - LastLoggedOnUser = DOMAIN\User.Name
Hope this helps.
Hi Experts,
I Found the answer and Here it is
Go to the Event Manager-> Security Logs
Sort the Logs by Event ID and Look for ID No: 528 ( Logon / Log off). This Displays the Name of the User Logged in / Logged off.
The latest by Time stamp for this event points the Last user logged in / Logged off.
Note : This will Contains System ID's as well
I Found the answer and Here it is
Go to the Event Manager-> Security Logs
Sort the Logs by Event ID and Look for ID No: 528 ( Logon / Log off). This Displays the Name of the User Logged in / Logged off.
The latest by Time stamp for this event points the Last user logged in / Logged off.
Note : This will Contains System ID's as well
Hi Bryan
Sorry that I Couldn't Find the registry key Authentication under
HKEY_LOCAL_MACHINE\SOFTWAR
In the System.
Sorry that I Couldn't Find the registry key Authentication under
HKEY_LOCAL_MACHINE\SOFTWAR
In the System.
Just to fill in, if you have multiple DCs it will only be logged on the DC that did the authentication. It will not replicate this information with other DCs.
To be 100 per cents certain, you should check the log on every DC and check find the latest timestamp.
Tools like EventCombMT is helpful in cases like this.
http://www.microsoft.com/downloads/en/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en
To be 100 per cents certain, you should check the log on every DC and check find the latest timestamp.
Tools like EventCombMT is helpful in cases like this.
http://www.microsoft.com/downloads/en/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en
Featured Post
We value your feedback.
Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP, Windows Server…
- Ransomware
- Experts Exchange
- Windows XP
- Windows OS
- Windows Server 2008
- Windows Server 2003, Security
With the power of JIRA, there's an unlimited number of ways you can customize it, use it and benefit from it. With that in mind, there's bound to be things that I wasn't able to cover in this course. With this summary we'll look at some places to go…
Suggested Courses
Course of the Month9 days, 9 hours left to enroll
762 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.