Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.
Sign up to join this community
Is there a way to get a list of the users that logged in last on a Windows XP machine.
What I want is basically what the unix command last does on windows.
The machine is in a domain, I have local admin rights.
EDIT: The answers from Chris, Molly and Nate were all correct and helpful. What solved my particular problem was the answer from Nate, so I accepted his answer. Thank you guys.
You could have a look at the modification times on the profiles, that might be more useful.
Have a look for "User profiles" in the properties of the machine (right near where you'd set Environment Variables).
If you have XP Professional you can always use the Event Viewer found under Administrative tools. With the event view up and running you can click on Security and see which user logged in at what time.
Hope this helps some.
You can audit the logon attempts via Group Policy:
Log on as an administrator
Click Start, click Run, type mmc /a (note the space between mmc and /a), and then click OK.
On the File menu, click Add/Remove Snap-in, and then click Add.
Under Snap-in, click Group Policy, and then click Add.
In Select Group Policy Object, click Local Computer, click Finish, click Close, and then click OK.
At this point, you might want to save this console for further use. Note: you can add multiple snap-in and manage multiple computers from this console.
On the left hand side, navigate to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy
On the right hand side, double-click "Audit Logon Events"
Check the boxes for Success and Failure, click OK
Now anytime a logon is attempted an entry will be created in the Security Log, which you can view with the Event Viewer.
