Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

From a Windows XP command line, how do I get the time I logged into and/or out of the current machine? I'm looking for something like the UNIX last command which lists active and previous login sessions.

Thanks,

John

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

The quser.exe utility, which ships on Windows Server 2003 and newer, will work under Windows XP and will return the current logon time of the console session.

You could also query the logon time from WMI via a script:

Function WMIDateToString(varWMIDate)
    WMIDateToString = Mid(varWMIDate, 5, 2) & "/" & Mid(varWMIDate, 7, 2) & "/" & Left(varWMIDate, 4) & " " & Mid

(varWMIDate, 9, 2) & ":" & Mid(varWMIDate, 11, 2) & ":" & Mid(varWMIDate, 13, 2)
End Function

For Each usr In GetObject("winmgmts:").ExecQuery("SELECT * FROM Win32_NetworkLoginProfile")
    WScript.Echo usr.Caption
    WScript.Echo WMIDateToString(usr.LastLogOn)
Next

As far as prior logons go, you're going to be stuck parsing the event log, assuming that you had auditing of successful logons enabled.

Event 528 from source "Security" is logged in the "Security" event log each time there's a successful logon. Logons with a "Logon Type" of "2" are interactive logons at the console.

Event 538 from source "Security" is logged in the "Security" event log when the user logoff occurs. You'll have to match the "Logon ID" from the logon event with the logoff event in order to compute times.

share|improve this answer
add comment

You can also just type in query user from an XP Command prompt. As far as previous logins you will have to have had auditing enabled in order to query the event log

share|improve this answer
    
'query" is not a standard XP command, so you must have installed something else to get it. –  John Gardeniers May 12 '10 at 21:24
    
Ahh apparently so (just built an OOB XP system and lo and behold you were right), I suspect either the admin pak or the resource kit. It does appear to be in standard builds of windows 7 and vista (can anyone confirm?) –  Jim B May 12 '10 at 22:21
    
I can confirm on Windows 7. That's a pretty awesome command! –  Nixphoe Aug 6 '11 at 17:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.