Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From a Windows XP command line, how do I get the time I logged into and/or out of the current machine? I'm looking for something like the UNIX last command which lists active and previous login sessions.



share|improve this question
up vote 6 down vote accepted

The quser.exe utility, which ships on Windows Server 2003 and newer, will work under Windows XP and will return the current logon time of the console session.

You could also query the logon time from WMI via a script:

Function WMIDateToString(varWMIDate)
    WMIDateToString = Mid(varWMIDate, 5, 2) & "/" & Mid(varWMIDate, 7, 2) & "/" & Left(varWMIDate, 4) & " " & Mid

(varWMIDate, 9, 2) & ":" & Mid(varWMIDate, 11, 2) & ":" & Mid(varWMIDate, 13, 2)
End Function

For Each usr In GetObject("winmgmts:").ExecQuery("SELECT * FROM Win32_NetworkLoginProfile")
    WScript.Echo usr.Caption
    WScript.Echo WMIDateToString(usr.LastLogOn)

As far as prior logons go, you're going to be stuck parsing the event log, assuming that you had auditing of successful logons enabled.

Event 528 from source "Security" is logged in the "Security" event log each time there's a successful logon. Logons with a "Logon Type" of "2" are interactive logons at the console.

Event 538 from source "Security" is logged in the "Security" event log when the user logoff occurs. You'll have to match the "Logon ID" from the logon event with the logoff event in order to compute times.

share|improve this answer

You can also just type in query user from an XP Command prompt. As far as previous logins you will have to have had auditing enabled in order to query the event log

share|improve this answer
'query" is not a standard XP command, so you must have installed something else to get it. – John Gardeniers May 12 '10 at 21:24
Ahh apparently so (just built an OOB XP system and lo and behold you were right), I suspect either the admin pak or the resource kit. It does appear to be in standard builds of windows 7 and vista (can anyone confirm?) – Jim B May 12 '10 at 22:21
I can confirm on Windows 7. That's a pretty awesome command! – Nixphoe Aug 6 '11 at 17:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.