Last Logon Code

Topic

New Reply

Hi

I am looking for a simple vbs code to add to my startup folder which will tell me who logged on to the the pc last, can anyone help please.

Best Regards

Braddy

Reply | Quote

Replies

Simple google search;
http://www.rlmueller.net/Last%20Logon.htm
VBScript to get users last login
GOOGLE

Programs:
True Last Logon 2.9
RealLastLogon

Reply | Quote

Hi Clint

Thanks for the reply, most useful thanks

Braddy

Reply | Quote

Looks like the links Clint provided will tell you the last time a given user logged in, and most of those depend on Active Directory. But Braddy, isn’t your goal to find the account name of the person who logged onto your PC prior to you?

I know that you can find that information in the Security Log (Computer | Manage | System Tools | Event Viewer | Windows logs). Back up to the second occurrence of the Eventlog Service Shutdown entry (event ID 1100) [actually, the Security State change entry #4608 that denotes the lsass.exe startup might be even better], then go forward to the first Logon entry (ID # 4624) and look at the credentials – that’s who logged on prior to you.

Seems like it should not be that hard to come up with a PowerShell script to do this, perhaps even list the last N accounts that logged in. Seems like a worthwhile project, I’ll post the script when I have it (might take a few days tho).

Reply | Quote

Hi

Thanks to all who replied but I have settled for this simple vbs file, added to my startup folder is just what I was looking for.

Option Explicit
Dim objWMIService, colItems, WshNetwork, strComputer
Dim objUser, objItem, dtmLastLogin, strLogonInfo
Set WshNetwork = CreateObject(“Wscript.Network”)
strComputer = WshNetwork.ComputerName

Set objWMIService = GetObject(“winmgmts:\” & strComputer & “rootcimv2”)
Set colItems = objWMIService.ExecQuery _
(“Select * from Win32_UserAccount Where Domain = ‘” & strComputer & “‘”)

For Each objItem in colItems
dtmLastLogin = “”
On Error Resume Next
Set objUser = GetObject(“WinNT://” & strComputer _
& “/” & objItem.Name & “,user”)
dtmLastLogin = objUser.lastLogin
On Error Goto 0

strLogonInfo = strLogonInfo & vbCrLf & objItem.Name & “: ” & dtmLastLogin
Next
MsgBox strLogonInfo, vbOKOnly + vbInformation, “Last Logon Information for Local Users”

Regards

Braddy

Reply | Quote

Hi All,

I tried Braddy’s script and it worked just fine. However, I noticed a logon to the Guest Account which, as I verified, is disabled!
Here’s the info from the Security Log:

Code:

Audit Success	8/25/2010 11:03:06 AM	Microsoft Windows security auditing.	4624	Logon

Details:

Subject:
	Security ID:		Inspiron15-i5userid
	Account Name:		Bruce
	Account Domain:		Inspiron15-i5
	Logon ID:		0x63810

Logon Type:			3

New Logon:
	Security ID:		Inspiron15-i5Guest
	Account Name:		Guest
	Account Domain:		Inspiron15-i5
	Logon ID:		0x2b6feb
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Immediately following was:

Code:

Audit Success	8/25/2010 11:03:06 AM	Microsoft Windows security auditing.	4634	Logoff

Details:

An account was logged off.

Subject:
	Security ID:		Inspiron15-i5Guest
	Account Name:		Guest
	Account Domain:		Inspiron15-i5
	Logon ID:		0x2b6feb

Logon Type:			3

Anyone have an idea what’s going on?

May the Forces of good computing be with you!

RG

PowerShell & VBA Rule!
Computer Specs

Reply | Quote

And here is a quick-and-dirty PowerShell script that gives the last 10 logons. You can add it to your Startup menu if you like.

Code:

param($count = 10)
$lastLogon = $null
filter RecallLogon {
  #"]" + $_.ReplacementStrings[9] + "["
  if ($_.ReplacementStrings[9] -eq "User32 ") {$script:lastLogon = $_} else {$_}
}
filter PrintLogon {
  if ($_.InstanceID -eq 1100 -and $lastLogon) {
    "User " + $script:lastLogon.ReplacementStrings[5] + " logged in at " + $lastLogon.TimeGenerated
  }
}
get-eventlog -logname security | where {$_.EventID -eq 1100 -or $_.EventID -eq 4624} | RecallLogon | PrintLogon | Select -first $count

Reply | Quote