If you would like to check the last logon time for a user here’s how to do it.
Open command prompt in elevated mode (run as administrator) and type the following command:
net user username | findstr /B /C:"Last logon"
Where username is the name of the local user. For instance:
net user administrator | findstr /B /C:"Last logon"
If you would like to check the last logon time for a domain user, you should use the following command:
net user username /domain | findstr /B /C:"Last logon"
Where username is the name of the domain user you would like to check.
You should get a result as shown in the picture below:
You can also use ADSI Edit from Active Directory Administration tools.
Open ADSI Edit and navigate to the desired user. From the left pane right-click on the user and click properties.
In the Attribute editor scroll down to lastLogon attribute to check the users last logon time:
If you would like to monitor last logon times for users you should enable this setting in local security policy or in a domain policy.
Open group policy editor by running gpedit.msc command.
Navigate to:
Computer Configuration | Windows Settings | Security Settings | Local Policies | Audit Policy
In the right pane select Audit logon events. Check both Success and Failure, or just Success check boxes.
Close the policy editor and restart your machine. Logon event will now be recorded in Event Viewer | Windows Logs | Security.
Feel free to leave your comments below.