# Last Logged on User on Offline Windows Installation

Recently at work, I was wondering if there was a quick batch command I could use to look at some output and quickly determine which was the last user who logged on. Users do not have roaming profiles, and the local profiles often need to be recovered manually (I know, I know I work with crazy people). This means booting up WinPE on some failed computers and guessing who has not worked here for a long time, and making a judgement call on whether I can delete their refuse. So, I was thinking to look at the user profile directory (%SYSTEMDRIVE%\Users or %SYSTEMDRIVE%\Documents and Settings, what have you). Obviously, that was pretty inaccurate. Then, I thought NTUSER.DAT most be modified on every sequential login. Can I just look at that like so?

for /d %subdir in (*) do dir /ah %subdir\ntuser.dat | findstr /i "ntuser.dat > lastlogon.log


I usually need to do this on a busted PE image with no whizbang tools. Any thoughts?

-

You should have a look at LogParser utility. LogParser was written by a Microsoft employee in his spare time. It's an .exe that can run as a standalone utility without requiring "installation". It will even run when executed from a remote location such as \\server\share\logparser.exe or from within a remote RDP session as \\tsclient\c\path\to\logparser.exe

LogParser uses an SQL-like syntax to query Windows event logs -- even remotely! It can report results as nicely formatted .txt, .csv, .xml or even graphic charts output. (It can do much more than just query event logs, but this is what you need right now...). Try it:

logparser.exe -h examples


This will give you a few examples about what you can do with it. The next line will output the first 5 (oldest 5) events from the 'Application' eventlog of your own workstation:

logparser.exe "SELECT TOP 5 * FROM \\.\application"


The next query will output the top 20 events from 3 different eventlogs on 3 different servers:

1. 'Application' eventlog of remoteserver1 and
2. 'System' eventlog of remote2.
3. 'Security' eventlog of local system.

Try it (but write the following all in one line):

 LogParser.exe
"SELECT TOP 20 *
FROM \\remoteserver1\Application, \\remote2\System,\\.\Security
ORDER by TimeGenerated DESC"


It will output the query results as a list in your cmd.exe window, in descending order. By default it will prompt you after 10 lines for more output. Oh, and the commandline params aren't even case sensitive, in case you like all lower casing better for faster typing. Here is something that may help your current needs. Again, type it in one line:

 logparser
"select top 50
timegenerated as logondate,
extract_token(message, 0, ':') as logevent,
extract_token(strings, 1, '|') as domain
from security
where eventid not in (541;542;543)
and eventtype = 8
and eventcategory = 2 order by timegenerated desc"


Add -rtp:-1 if you want to override the defaualt value of 10 for rows to process, so you are not prompted for more output every 10 lines.

It will be easy to put a fitting log parser query into a batch file LastLogins.bat and store that somewhere in your %PATH%...

Caveats:

1. I have not really tested the above queries; you may need to tweak them for your own purpose.
2. In the past I have used LogParser heavily on Windows XP and Windows 2003 Server, where it worked well. But I have no experience whatsoever on Vista or Windows 7 with it.
3. PowerShell and the wmic.exe utility will be able to achieve similar things. It's just that logparser is my own preference for jobs like that.
-
I am going to wait and see other answers, but this is excellent. Thanks. I am looking for a cheap hack, but your approach is far more thorough. I will probably accept this as an answer, but just want to see what else comes up here and what other people do. – ajstein Sep 13 '10 at 11:58
@alharaka: If you like it, but don't "accept" it, you can still "upvote"... – Kurt Pfeifle Sep 13 '10 at 14:35
Well, no one ever had anything else to add. Your answer shows some good old know how. Enjoy the accepted answer! – ajstein Sep 19 '10 at 21:24