Who logs onto this computer?

One of the questions that is frequently asked in a large organization is, “Who uses computer XYZ123?”. Many tools will report the current user, but the current user may or may not be the the person who usually works on a given computer.  The current user for the computer you are logged on logged onto to fix is probably not the name you want.

In pre-Windows 7 days, I used to pull the user information from the registry location HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName.  I recently found out that this has been moved to HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\LastLoggedOnUser for Windows 7.

Unfortunately when I went looking in the new location, there was nothing there.  The missing LastLoggedOnUser was a weird problem.  After some Google search time I found that if you use a GPO entry to clear the last username then LastLoggedOnUser is not populated.

I then spent some time with WMI, and found some interesting information is available in Win32_NetworkLoginProfile.  I ended up writing two scripts:  LastUserLogon.vbs gets the last user for a computer, and TopComputerUsers.vbs (pulled, see below) which collects the top 5 interactive logons for a computer.  Both let you copy the data to the clipboard if Word is installed, otherwise the information can be output to notepad.

The TopComputerUsers script is interesting because WMI contains a count of user logons, and I use a disconnected recordset to sort the user information by number of logons.  The LastUserLogon gives you a subset of the information from TopComputerUsers, and can help you determine whether a given computer is underutilized.

Both will work on local or remote computers.  Both take a computer name as an argument.  And both scripts tell you who the current user is.

One thought on “Who logs onto this computer?

Leave a Reply