Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to get a list of the users that logged in last on a Windows XP machine. What I want is basically what the unix command last does on windows.

The machine is in a domain, I have local admin rights.

EDIT: The answers from Chris, Molly and Nate were all correct and helpful. What solved my particular problem was the answer from Nate, so I accepted his answer. Thank you guys.

share|improve this question
up vote 4 down vote accepted

You could have a look at the modification times on the profiles, that might be more useful.

Have a look for "User profiles" in the properties of the machine (right near where you'd set Environment Variables).

share|improve this answer
Thanks, this helped a lot. – user1863 Mar 2 '10 at 15:59
You could also look at the User folders (documents and settings). Aside from All Users and the hidden folders, they will belong to all users that have logged in. – SnOrfus Mar 2 '10 at 22:16

If you have XP Professional you can always use the Event Viewer found under Administrative tools. With the event view up and running you can click on Security and see which user logged in at what time.

Hope this helps some.

share|improve this answer
Security in Event Viewer seems exactly the right place for this kind of information. Only thing is: On my machine there are no entries like that. I logged im at 8:00 and there is an entry 7:47 "Erfolgsüberw." and one 9:30 "Erfolgsüberw.", nothing in between. Can you tell me how the entries are supposed to look like? I have a German Version of Windows but if you know the Englisch entries it would be helpful as well. – user1863 Mar 2 '10 at 15:16

You can audit the logon attempts via Group Policy:

  • Log on as an administrator

  • Click Start, click Run, type mmc /a (note the space between mmc and /a), and then click OK.

  • On the File menu, click Add/Remove Snap-in, and then click Add.

  • Under Snap-in, click Group Policy, and then click Add.

  • In Select Group Policy Object, click Local Computer, click Finish, click Close, and then click OK.

At this point, you might want to save this console for further use. Note: you can add multiple snap-in and manage multiple computers from this console.

  • On the left hand side, navigate to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy

  • On the right hand side, double-click "Audit Logon Events"

  • Check the boxes for Success and Failure, click OK

Now anytime a logon is attempted an entry will be created in the Security Log, which you can view with the Event Viewer.

share|improve this answer
Sounds good. Unfortunately I currently have an open session I would like to know the last logins. As I understand your advice will only work for future logins? – user1863 Mar 2 '10 at 15:37
Yes, what is described would be for future logins. You might be able to check the date/time on NTUSER.DAT in each of the users directories (under Documents and Settings) to determine who last logged in. – Michael Todd Mar 2 '10 at 15:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .