Is there a way to get a list of the users that logged in last on a Windows XP machine. What I want is basically what the unix command last does on windows.

The machine is in a domain, I have local admin rights.

EDIT: The answers from Chris, Molly and Nate were all correct and helpful. What solved my particular problem was the answer from Nate, so I accepted his answer. Thank you guys.

3 Answers 3


You could have a look at the modification times on the profiles, that might be more useful.

Have a look for "User profiles" in the properties of the machine (right near where you'd set Environment Variables).

  • 2
    You could also look at the User folders (documents and settings). Aside from All Users and the hidden folders, they will belong to all users that have logged in. Mar 2, 2010 at 22:16

If you have XP Professional you can always use the Event Viewer found under Administrative tools. With the event view up and running you can click on Security and see which user logged in at what time.

Hope this helps some.

  • 1
    Security in Event Viewer seems exactly the right place for this kind of information. Only thing is: On my machine there are no entries like that. I logged im at 8:00 and there is an entry 7:47 "Erfolgsüberw." and one 9:30 "Erfolgsüberw.", nothing in between. Can you tell me how the entries are supposed to look like? I have a German Version of Windows but if you know the Englisch entries it would be helpful as well.
    – user1863
    Mar 2, 2010 at 15:16

You can audit the logon attempts via Group Policy:

  • Log on as an administrator

  • Click Start, click Run, type mmc /a (note the space between mmc and /a), and then click OK.

  • On the File menu, click Add/Remove Snap-in, and then click Add.

  • Under Snap-in, click Group Policy, and then click Add.

  • In Select Group Policy Object, click Local Computer, click Finish, click Close, and then click OK.

At this point, you might want to save this console for further use. Note: you can add multiple snap-in and manage multiple computers from this console.

  • On the left hand side, navigate to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy

  • On the right hand side, double-click "Audit Logon Events"

  • Check the boxes for Success and Failure, click OK

Now anytime a logon is attempted an entry will be created in the Security Log, which you can view with the Event Viewer.

  • 1
    Sounds good. Unfortunately I currently have an open session I would like to know the last logins. As I understand your advice will only work for future logins?
    – user1863
    Mar 2, 2010 at 15:37
  • 2
    Yes, what is described would be for future logins. You might be able to check the date/time on NTUSER.DAT in each of the users directories (under Documents and Settings) to determine who last logged in. Mar 2, 2010 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.