Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If anyone could help, it would be appreciated. I am trying to audit the network. I have list of computers that are active in last 3 months in domain. I have little script that run when user login to the computer and writes the file with computer name. I have 39 computers and only on 23 computers the script was run. So I am chasing up with other 16 computers. My question is how can I find out who has last login to the given computer name?

Many thanks in advance

share|improve this question

Look in the Security Event Log on those machines. There will be all logon events audited there.

You can filter the logs for event 528. The logon type that you're looking for in those events is 2, which is an interactive logon.

share|improve this answer
I would probably do the same, with only difference: Edit GPO to track users Logon/Logoff. Then, if a user logs on with a domain account, log on event will be created on a local machine and on a DC which processed log on request. How to track users logon/logoff This will allow to view all of the events on a single DC (if there are more than one DC, you can connect to remote EventViewer via Event Viewer mmc > Connect to another computer option). – Volodymyr M. Nov 7 '12 at 5:59

The registry key, that MDMarra is referring to should be HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI (assuming later than XP). Look in LastLoggedOnUser.

share|improve this answer
That was a big help to me, Thanks! – Alireza Maddah Sep 14 '15 at 7:53

Create a login script that logs usernames and dates for each machine on a network share. For example, append %username% and %date% information to the file %computername%.txt Then whenever you have a question about who logged into a computer, it should be in chronological order in the file.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.