Results 1 to 7 of 7

Thread: Last Logon Code

  1. #1
    Silver Lounger
    Join Date
    Dec 2000
    Location
    Northampton, Northamptonshire, England
    Posts
    1,951
    Thanks
    2
    Thanked 1 Time in 1 Post
    Hi

    I am looking for a simple vbs code to add to my startup folder which will tell me who logged on to the the pc last, can anyone help please.

    Best Regards

    Braddy
    If you are a fool at forty, you will always be a fool

  2. #2
    Super Moderator CLiNT's Avatar
    Join Date
    Dec 2009
    Location
    California & Arizona
    Posts
    6,121
    Thanks
    160
    Thanked 609 Times in 557 Posts
    DRIVE IMAGING
    Invest a little time and energy in a well thought out BACKUP regimen and you will have minimal down time, and headache.

    Build your own system; get everything you want and nothing you don't.
    Latest Build:
    ASUS X99 Deluxe, Core i7-5960X, Corsair Hydro H100i, Plextor M6e 256GB M.2 SSD, Corsair DOMINATOR Platinum 32GB DDR4@2666, W8.1 64 bit,
    EVGA GTX980, Seasonic PLATINUM-1000W PSU, MountainMods U2-UFO Case, and 7 other internal drives.

  3. #3
    Silver Lounger
    Join Date
    Dec 2000
    Location
    Northampton, Northamptonshire, England
    Posts
    1,951
    Thanks
    2
    Thanked 1 Time in 1 Post
    Hi Clint

    Thanks for the reply, most useful thanks

    Braddy
    If you are a fool at forty, you will always be a fool

  4. #4
    5 Star Lounger
    Join Date
    Jan 2010
    Location
    Los Angeles, CA
    Posts
    828
    Thanks
    4
    Thanked 38 Times in 34 Posts
    Looks like the links Clint provided will tell you the last time a given user logged in, and most of those depend on Active Directory. But Braddy, isn't your goal to find the account name of the person who logged onto your PC prior to you?

    I know that you can find that information in the Security Log (Computer | Manage | System Tools | Event Viewer | Windows logs). Back up to the second occurrence of the Eventlog Service Shutdown entry (event ID 1100) [actually, the Security State change entry #4608 that denotes the lsass.exe startup might be even better], then go forward to the first Logon entry (ID # 4624) and look at the credentials - that's who logged on prior to you.

    Seems like it should not be that hard to come up with a PowerShell script to do this, perhaps even list the last N accounts that logged in. Seems like a worthwhile project, I'll post the script when I have it (might take a few days tho).

  5. #5
    Silver Lounger
    Join Date
    Dec 2000
    Location
    Northampton, Northamptonshire, England
    Posts
    1,951
    Thanks
    2
    Thanked 1 Time in 1 Post
    Hi


    Thanks to all who replied but I have settled for this simple vbs file, added to my startup folder is just what I was looking for.

    Option Explicit
    Dim objWMIService, colItems, WshNetwork, strComputer
    Dim objUser, objItem, dtmLastLogin, strLogonInfo
    Set WshNetwork = CreateObject("Wscript.Network")
    strComputer = WshNetwork.ComputerName

    Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    Set colItems = objWMIService.ExecQuery _
    ("Select * from Win32_UserAccount Where Domain = '" & strComputer & "'")

    For Each objItem in colItems
    dtmLastLogin = ""
    On Error Resume Next
    Set objUser = GetObject("WinNT://" & strComputer _
    & "/" & objItem.Name & ",user")
    dtmLastLogin = objUser.lastLogin
    On Error Goto 0

    strLogonInfo = strLogonInfo & vbCrLf & objItem.Name & ": " & dtmLastLogin
    Next
    MsgBox strLogonInfo, vbOKOnly + vbInformation, "Last Logon Information for Local Users"


    Regards

    Braddy
    If you are a fool at forty, you will always be a fool

  6. #6
    Super Moderator RetiredGeek's Avatar
    Join Date
    Mar 2004
    Location
    Manning, South Carolina
    Posts
    9,436
    Thanks
    372
    Thanked 1,457 Times in 1,326 Posts
    Hi All,

    I tried Braddy's script and it worked just fine. However, I noticed a logon to the Guest Account which, as I verified, is disabled!
    Here's the info from the Security Log:

    Code:
    Audit Success	8/25/2010 11:03:06 AM	Microsoft Windows security auditing.	4624	Logon
    
    Details:
    
    Subject:
    	Security ID:		Inspiron15-i5\userid
    	Account Name:		Bruce
    	Account Domain:		Inspiron15-i5
    	Logon ID:		0x63810
    
    Logon Type:			3
    
    New Logon:
    	Security ID:		Inspiron15-i5\Guest
    	Account Name:		Guest
    	Account Domain:		Inspiron15-i5
    	Logon ID:		0x2b6feb
    	Logon GUID:		{00000000-0000-0000-0000-000000000000}
    Immediately following was:

    Code:
    Audit Success	8/25/2010 11:03:06 AM	Microsoft Windows security auditing.	4634	Logoff
    
    Details:
    
    An account was logged off.
    
    Subject:
    	Security ID:		Inspiron15-i5\Guest
    	Account Name:		Guest
    	Account Domain:		Inspiron15-i5
    	Logon ID:		0x2b6feb
    
    Logon Type:			3

    Anyone have an idea what's going on?
    May the Forces of good computing be with you!

    RG

    PowerShell & VBA Rule!

    My Systems: Desktop Specs
    Laptop Specs

  7. #7
    5 Star Lounger
    Join Date
    Jan 2010
    Location
    Los Angeles, CA
    Posts
    828
    Thanks
    4
    Thanked 38 Times in 34 Posts
    And here is a quick-and-dirty PowerShell script that gives the last 10 logons. You can add it to your Startup menu if you like.

    Code:
    param($count = 10)
    $lastLogon = $null
    filter RecallLogon {
      #"]" + $_.ReplacementStrings[9] + "["
      if ($_.ReplacementStrings[9] -eq "User32 ") {$script:lastLogon = $_} else {$_}
    }
    filter PrintLogon {
      if ($_.InstanceID -eq 1100 -and $lastLogon) {
        "User " + $script:lastLogon.ReplacementStrings[5] + " logged in at " + $lastLogon.TimeGenerated
      }
    }
    get-eventlog -logname security | where {$_.EventID -eq 1100 -or $_.EventID -eq 4624} | RecallLogon | PrintLogon | Select -first $count

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •