Finding Last Logged-on User

by Apr 1, 2021

To find details about the last logged-on user on Windows, you can query the registry:

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" |
  Select-Object -Property LastLo*, Idle*

The result looks similar to this:

LastLoggedOnDisplayName : Tobias Weltner
LastLoggedOnProvider    : {D6886603-9D2F-4EB2-B667-1971041FA96B}
LastLoggedOnSAMUser     : .\tobia
LastLoggedOnUser        : .\tobia
LastLoggedOnUserSID     : S-1-5-21-2770831484-2260150476-2133527644-1001
IdleTime                : 62486093   

Likewise, this line returns all the user profiles registered in the Windows registry:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\profilelist\*' |
Select-Object -Property ProfileImagePath, FullProfile

Twitter This Tip! ReTweet this Tip!