Alan's Blog

"Yeah. I wrote a script that will do that."

Who logs onto this computer?

Posted on February 3rd, 2012

One of the questions that is frequently asked in a large organization is, “Who uses computer XYZ123?”. Many tools will report the current user, but the current user may or may not be the the person who usually works on a given computer.  The current user for the computer you are logged on logged onto to fix is probably not the name you want.

In pre-Windows 7 days, I used to pull the user information from the registry location HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName.  I recently found out that this has been moved to HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\LastLoggedOnUser for Windows 7.

Unfortunately when I went looking in the new location, there was nothing there.  The missing LastLoggedOnUser was a weird problem.  After some Google search time I found that if you use a GPO entry to clear the last username then LastLoggedOnUser is not populated.

I then spent some time with WMI, and found some interesting information is available in Win32_NetworkLoginProfile.  I ended up writing two scripts:  LastUserLogon.vbs gets the last user for a computer, and TopComputerUsers.vbs (pulled, see below) which collects the top 5 interactive logons for a computer.  Both let you copy the data to the clipboard if Word is installed, otherwise the information can be output to notepad.

The TopComputerUsers script is interesting because WMI contains a count of user logons, and I use a disconnected recordset to sort the user information by number of logons.  The LastUserLogon gives you a subset of the information from TopComputerUsers, and can help you determine whether a given computer is underutilized.

Both will work on local or remote computers.  Both take a computer name as an argument.  And both scripts tell you who the current user is.

Filed under VbScript, Windows 7, Windows Administration, WMI |

One Response to “Who logs onto this computer?”

  1. Alan Says:
    October 26th, 2012 at 3:33 PM

    Unfortunately the data TopComputerUsers.vbs returns is BOGUS. The total number of logons is not returned (or maintained) by the local machine, but rather reports the logons to the domain. See: You can, however use it for the most recent logon, so the other script is okay.

Leave a Reply

You must be logged in to post a comment.

Please Note:

All the scripts are saved as .txt files. Newer files have a "View Script" button which will let you save or open a script in notepad. For earlier posts, the easiest way to download with IE is to right click on the link and use "Save Target As". Rename file from Name_ext.txt to Name.ext.

To see a full post after searching, please click on the title.

PowerShell Scripts were written with Version 3 or 4.

https connections are supported.

All new users accounts must be approved, as are comments. Please be patient. It is pretty easy to figure out my email address from the scripts, and you are welcome to contact me that way.


Bad Behavior has blocked 174 access attempts in the last 7 days.