<p>If you would like to check the last logon time for a user here&#8217;s how to do it.</p>
<p>Open command prompt in elevated mode (run as administrator) and type the following command:</p>
<pre>net user username | findstr /B /C:"Last logon"</pre>
<p>Where username is the name of the local user. For instance:</p>
<pre>net user administrator | findstr /B /C:"Last logon"</pre>
<p>If you would like to check the last logon time for a domain user, you should use the following command:</p>
<pre>net user username /domain | findstr /B /C:"Last logon"</pre>
<p>Where username is the name of the domain user you would like to check.<!--more--></p>
<p>You should get a result as shown in the picture below:</p>
<p><a href="https://www.wincert.net/wp-content/uploads/2016/02/last-logon.png" rel="attachment wp-att-1739"><img class="alignnone wp-image-1739 size-full" src="https://www.wincert.net/wp-content/uploads/2016/02/last-logon.png" alt="last logon" width="603" height="113" /></a></p>
<p>You can also use ADSI Edit from Active Directory Administration tools.</p>
<p>Open ADSI Edit and navigate to the desired user. From the left pane right-click on the user and click properties.</p>
<p>In the Attribute editor scroll down to <strong>lastLogon attribute</strong> to check the users last logon time:</p>
<p><a href="https://www.wincert.net/wp-content/uploads/2016/02/last-logon-time.png" rel="attachment wp-att-1740"><img class="alignnone wp-image-1740 size-full" src="https://www.wincert.net/wp-content/uploads/2016/02/last-logon-time.png" alt="last logon time" width="374" height="157" /></a></p>
<p>If you would like to monitor last logon times for users you should enable this setting in local security policy or in a domain policy.</p>
<p>Open group policy editor by running <strong>gpedit.msc</strong> command.</p>
<p>Navigate to:<br />
<strong>Computer Configuration | Windows Settings | Security Settings | Local Policies | Audit Policy</strong></p>
<p>In the right pane select <strong>Audit logon events</strong>. Check both <strong>Success</strong> and <strong>Failure</strong>, or just <strong>Success</strong> check boxes.</p>
<p>Close the policy editor and restart your machine. Logon event will now be recorded in <strong>Event Viewer | Windows Logs | Security</strong>.</p>
<p>Feel free to leave your comments below.</p>

Get Last Logon time for a user
