≡ Menu

Last logon time of user

Using ‘Net user’ command we can find the last login time of a user. The exact command is given below.

net user  username | findstr /B /C:"Last logon"

To find the last login time of the computer administrator

C:\> net user administrator | findstr /B /C:"Last logon"
Last logon                   6/30/2010 10:02 AM

For a domain user, the command would be as below.

C:\>net user john /domain | findstr /C:"Last logon"
Last logon                   9/18/2013 10:18:41 AM
17 comments… add one
  • Anonymous

    How to find the last user logged into the machine?
    IS there any way to find this from command line?

    • kumar

      Import-Module ActiveDirectory

      function Get-ADUserLastLogon([string]$userName)
      $dcs = Get-ADDomainController -Filter {Name -like “*”}
      $time = 0
      foreach($dc in $dcs)
      $hostname = $dc.HostName
      $user = Get-ADUser $userName | Get-ADObject -Properties lastLogon
      if($user.LastLogon -gt $time)
      $time = $user.LastLogon
      $dt = [DateTime]::FromFileTime($time)
      Write-Host $username “last logged on at:” $dt }

      Get-ADUserLastLogon -UserName XXXXX

  • Techblogger

    I think from event log we can find the last logged in user name. I do not know of any way to know this from command line.

  • Duyz

    I run CMD with Admin right. But I receive MSG: “FINDSTR: Can not open logon”?

    May you explain me?

    Thank you.

    • admin

      I think you have executed something like below
      net user administrator | findstr /B /C:Last logon
      You may have missed double quotes around ‘Last Logon’. Run the command “net user administrator | findstr /B /C:”Last logon”. It would print the last login time.

  • Nurain Akram

    what command to use if we want to see last 5 logons ??

  • XYZ

    You can also see it by typing this in cmd (Command Prompt):

    net user(press enter key)

    then again type
    net user xxx

    xxx- name of username you obtained from first command of net user

  • JSMorley

    I think net user xxx will only show the last time the user “logged on”, which will not be reflected in a restart of Windows if you have the account set to not require a password logon initially. This date and time will only be accurate if the user had to actually put in a password and “log on”.

    I think a better alternative is

    quser xxx

    This will show the date and time the user account logged on, and will reflect any restart of Windows that bypassed the login process.

    C:>quser Jeffrey
    >jeffrey console 2 Active none 1/16/2016 11:20 AM

  • Elías González

    How can I use this to show more than one value. In example if may wanted to show User name and Password last set. Thanks!

  • Jared

    Is there a way to run this command on an OU in AD so that I could export a list of users in said OU with their last log on dates?

  • hardik

    ‘net’ is not recognized as an internal or extarnal command,operable program or batch file

    this is occur what can i do for it..

  • Noor Azlan

    Is there a way in CMD to get last 3~6 user logon with date & time or duration & save it in text file. I have a hard time to find a culprit student who love to sabotage my labs keyboard button.

  • Christian Blackburn

    QUser cblackburn was what I needed thank you. Is there a different command that will show me the last time I locked or unlocked the machine which would still be more recent. I know this is in the event viewer, but it’s a mess.

  • Matthew

    Works perfectly for local users on Server 2008 R2

  • Sab

    what command to use if we want to see last 10 logons ??

  • Anonymous 2

    How can one find the last time a user logged into a machine?
    IS there any way to find this from command line?

    kumar’s answer does not work for A user, on A machine. It provides when the user logged into some computer on the domain.

  • Anders Blom

    This only works for local accounts.

Cancel reply

Leave a Comment