See what time a user logged into a windows box

Question

From a Windows XP command line, how do I get the time I logged into and/or out of the current machine? I'm looking for something like the UNIX last command which lists active and previous login sessions.

Thanks,

John

Solution 1

The quser.exe utility, which ships on Windows Server 2003 and newer, will work under Windows XP and will return the current logon time of the console session.

You could also query the logon time from WMI via a script:

Function WMIDateToString(varWMIDate)
    WMIDateToString = Mid(varWMIDate, 5, 2) & "/" & Mid(varWMIDate, 7, 2) & "/" & Left(varWMIDate, 4) & " " & Mid

(varWMIDate, 9, 2) & ":" & Mid(varWMIDate, 11, 2) & ":" & Mid(varWMIDate, 13, 2)
End Function

For Each usr In GetObject("winmgmts:").ExecQuery("SELECT * FROM Win32_NetworkLoginProfile")
    WScript.Echo usr.Caption
    WScript.Echo WMIDateToString(usr.LastLogOn)
Next

As far as prior logons go, you're going to be stuck parsing the event log, assuming that you had auditing of successful logons enabled.

Event 528 from source "Security" is logged in the "Security" event log each time there's a successful logon. Logons with a "Logon Type" of "2" are interactive logons at the console.

Event 538 from source "Security" is logged in the "Security" event log when the user logoff occurs. You'll have to match the "Logon ID" from the logon event with the logoff event in order to compute times.

Solution 2

You can also just type in query user from an XP Command prompt. As far as previous logins you will have to have had auditing enabled in order to query the event log

Comments

[John Gardeniers]

'query" is not a standard XP command, so you must have installed something else to get it.

[raja]

Ahh apparently so (just built an OOB XP system and lo and behold you were right), I suspect either the admin pak or the resource kit. It does appear to be in standard builds of windows 7 and vista (can anyone confirm?)

[Nixphoe]

I can confirm on Windows 7. That's a pretty awesome command!