How To Find User's Last Logon Time In A Workstation - ManageEngine

Maybe your like

Support Phone Get Quote Support US: +1 888 720 9500 US: +1 888 791 1189 Intl: +1 925 924 9500 Aus: +1 800 631 268 UK: 0800 028 6590 CN: +86 400 660 8680

Direct Inward Dialing: +1 408 916 9892

How to find user's last logon time on a workstation

System administrators use the computers' last logon by users report to check for unauthorized logons to their organization's Active Directory. In the event of a cyber attack, having a report of the users' last logon time on a workstation can accelerate forensic analysis and contain the damage.

The following is a comparison to obtain a user's last logon on a workstation using native auditing and ManageEngine's ADAudit Plus, a comprehensive real-time Active Directory auditing solution.

Download for FREE Free, fully functional 30-day trial

With Native AD Auditing
With ADAudit Plus

Using ManageEngine's ADAudit Plus to obtain a user's last logon on a workstation:

Login to ADAudit Plus web console as an administrator.
Navigate to the Reports tab and from the User Logon Reports section in the left pane, select Last Logon on Workstations.
In the top right corner, select the Domain from the drop down list and click Generate.
Select Export As to export the report in any of the preferred formats (CSV, PDF, HTML, CSVDE and XLSX).
Following are the limitations to obtain a report of a user's last logon on a computer using native tools like Windows PowerShell:
The script can be executed only from the computers which has Active Directory Domain Services role and auditing needs to be turned on on each computer.
It's difficult to change date formats, and apply different time zones on the date results.
To obtain the report in a different file format, the script must be modified accordingly which is a time-consuming and redundant process.
Applying more filters like OU or 'User name starts with' will increase the LDAP query complexity.
ADAudit Plus will generate the report of last logon of users in a particular workstation and display it in a simple and intuitively designed UI.

Using native auditing to find a user's last logon time on a workstation:

Step 1: Open Active Directory Users and Computers and make sure Advanced features is turned on.
Step 2: Browse and open the user account.
Step 3: Click on Attribute Editor.
Step 4: Scroll down to view the last Logon time.

If you have multiple domain controllers, you will need to check this value on each one to find the most recent time.

Native auditing becoming a little too much?

Simplify Active Directory auditing and reporting with ADAudit Plus.

Get Your Free Trial Fully functional 30-day trial

Related How-tos

How to monitor changes to files and folder permissions?
How to track folder and file creation and deletion in windows?
How to monitor file and folder access on a windows file server?
How to track who changed a file or a folder in windows?
How to audit shared folder access changes?
How to track changes in shared folder on file server?
How to audit failed access attempts to a shared folder?
How to detect who attempted to modify a file?

Request 1-on-1 demo

Requested Time 10:00 am 10:30 am 11:00 am 11:30 am 12:00 pm 12:30 pm 1:00 pm 1:30 pm 2:00 pm 2:30 pm 3:00 pm 3:30 pm 4:00 pm 4:30 pm 5:00 pm
-Select-
By clicking 'Submit' you agree to processing of personal data according to the Privacy Policy.