≡ Menu

Last logon time of user

Using ‘Net user’ command we can find the last login time of a user. The exact command is given below.

net user  username | findstr /B /C:"Last logon"

Example:
To find the last login time of the computer administrator

C:\> net user administrator | findstr /B /C:"Last logon"
Last logon                   6/30/2010 10:02 AM
C:>

For a domain user, the command would be as below.

C:\>net user john /domain | findstr /C:"Last logon"
Last logon                   9/18/2013 10:18:41 AM
26 comments… add one
  • Anonymous

    How to find the last user logged into the machine?
    IS there any way to find this from command line?

    • kumar

      Import-Module ActiveDirectory

      function Get-ADUserLastLogon([string]$userName)
      {
      $dcs = Get-ADDomainController -Filter {Name -like “*”}
      $time = 0
      foreach($dc in $dcs)
      {
      $hostname = $dc.HostName
      $user = Get-ADUser $userName | Get-ADObject -Properties lastLogon
      if($user.LastLogon -gt $time)
      {
      $time = $user.LastLogon
      }
      }
      $dt = [DateTime]::FromFileTime($time)
      Write-Host $username “last logged on at:” $dt }

      Get-ADUserLastLogon -UserName XXXXX

  • Techblogger

    I think from event log we can find the last logged in user name. I do not know of any way to know this from command line.

  • Duyz

    I run CMD with Admin right. But I receive MSG: “FINDSTR: Can not open logon”?

    May you explain me?

    Thank you.

    • admin

      I think you have executed something like below
      net user administrator | findstr /B /C:Last logon
      You may have missed double quotes around ‘Last Logon’. Run the command “net user administrator | findstr /B /C:”Last logon”. It would print the last login time.

  • Nurain Akram

    what command to use if we want to see last 5 logons ??

  • XYZ

    You can also see it by typing this in cmd (Command Prompt):

    net user(press enter key)

    then again type
    net user xxx

    xxx- name of username you obtained from first command of net user

  • JSMorley

    I think net user xxx will only show the last time the user “logged on”, which will not be reflected in a restart of Windows if you have the account set to not require a password logon initially. This date and time will only be accurate if the user had to actually put in a password and “log on”.

    I think a better alternative is

    quser xxx

    This will show the date and time the user account logged on, and will reflect any restart of Windows that bypassed the login process.

    C:>quser Jeffrey
    USERNAME SESSIONNAME ID STATE IDLE TIME LOGON TIME
    >jeffrey console 2 Active none 1/16/2016 11:20 AM

    • Jocelyn

      quser worked perfectly!! I was having trouble with “net user” on my work computer because of how the network is configured (I don’t have admin rights) but quser worked!

  • Elías González

    How can I use this to show more than one value. In example if may wanted to show User name and Password last set. Thanks!

  • Jared

    Is there a way to run this command on an OU in AD so that I could export a list of users in said OU with their last log on dates?

  • hardik

    ‘net’ is not recognized as an internal or extarnal command,operable program or batch file

    this is occur what can i do for it..

  • Noor Azlan

    Is there a way in CMD to get last 3~6 user logon with date & time or duration & save it in text file. I have a hard time to find a culprit student who love to sabotage my labs keyboard button.

  • Christian Blackburn

    QUser cblackburn was what I needed thank you. Is there a different command that will show me the last time I locked or unlocked the machine which would still be more recent. I know this is in the event viewer, but it’s a mess.

  • Matthew

    Works perfectly for local users on Server 2008 R2

  • Sab

    what command to use if we want to see last 10 logons ??

  • Anonymous 2

    How can one find the last time a user logged into a machine?
    IS there any way to find this from command line?

    kumar’s answer does not work for A user, on A machine. It provides when the user logged into some computer on the domain.

  • Anders Blom

    This only works for local accounts.

    • William (Kip) Dole

      Did you try the /DOMAIN switch after the logon name?

  • Bakkar

    which command ?? to see which last user has used the following machine xxx.

  • David

    this needs to be updated for Windows 10, since users often logon with PIN or face. There should be another different cmd to display the last “logon” from that. People don’t typically logon with a password any more. It’s mostly with PIN or face.

    • Along

      For 1809 and upper builds this solution not work 100%
      CMD was return nothing.

  • Cesar Le Fevere

    How can change the cmd to obtain this for all local users at once.
    So I would not have to retype this cmd for every single user.

    • Diiko

      SETLOCAL EnableDelayedExpansion
      FOR /D %%A in (“c:\Users\*”) DO (
      set “userProfile=%%~nxA”
      net user !userProfile! /domain | findstr /C:”Last logon”
      )

  • Find won’t work if the output is localized

  • Diiko

    net user john /domain | findstr /C:”Last logon”

    This may not give a logon date if you have multiple domain controllers. For example newer domain controllers may not have a logon date for a user.

Cancel reply

Leave a Comment