How to find user's last logon time on a workstation

System administrators use the computers' last logon by users report to check for unauthorized logons to their organization's Active Directory. In the event of a cyber attack, having a report of the users' last logon time on a workstation can accelerate forensic analysis and contain the damage.

The following is a comparison to obtain a user's last logon on a workstation using native auditing and ManageEngine's ADAudit Plus, a comprehensive real-time Active Directory auditing solution.

Download for FREE Free, fully functional 30-day trial
  • With Native AD Auditing

  • With ADAudit Plus

Using ManageEngine's ADAudit Plus to obtain a user's last logon on a workstation:

  • Login to ADAudit Plus web console as an administrator.

  • Navigate to the Reports tab and from the User Logon Reports section in the left pane, select Last Logon on Workstations.

  • In the top right corner, select the Domain from the drop down list and click Generate.

  • Select Export As to export the report in any of the preferred formats (CSV, PDF, HTML, CSVDE and XLSX).

  • Following are the limitations to obtain a report of a user's last logon on a computer using native tools like Windows PowerShell:

  • The script can be executed only from the computers which has Active Directory Domain Services role and auditing needs to be turned on on each computer.

  • It's difficult to change date formats, and apply different time zones on the date results.

  • To obtain the report in a different file format, the script must be modified accordingly which is a time-consuming and redundant process.

  • Applying more filters like OU or 'User name starts with' will increase the LDAP query complexity.

  • ADAudit Plus will generate the report of last logon of users in a particular workstation and display it in a simple and intuitively designed UI.

Using native auditing to find a user's last logon time on a workstation:

  • Step 1: Open Active Directory Users and Computers and make sure Advanced features is turned on.

  • Step 2: Browse and open the user account.

  • Step 3: Click on Attribute Editor.

  • Step 4: Scroll down to view the last Logon time.

    If you have multiple domain controllers, you will need to check this value on each one to find the most recent time.

Native auditing becoming a little too much?

Simplify Active Directory auditing and reporting with ADAudit Plus.

Get Your Free Trial Fully functional 30-day trial

Related How-tos

Request Support


One of our solution experts will get in touch with you shortly.

    Please enter business email address
  • By clicking 'Send Request', you agree to processing of personal data according to the Privacy Policy.

© 2019 Zoho Corp. All rights reserved.