Get Last Logged On User From Registry

Oct 12th, 2011 | Posted by | Filed under Windows

There are many ways to determine the user account that is currently logged on and this is not what I want to write about. Hint: Check Win32_ComputerSystem class and Username property value.

I was looking into ways to determine the user who was logged on last on a remote computer (even if there’s no one logged on currently). As it turned out there are differences in Windows XP and Windows 7. The answer lies in registry in both cases but under different keys.

So, to get last logged on user, you’ll get it from registry as follows:

  • Windows XP
    • Key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
    • Value(s): DefaultUserName (DefaultDomainName contains account’s domain)
  • Windows 7
    • Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI
    • Value: LastLoggedOnUser
No comments yet.