How to Find Users Last Logon Computer and Time in Active Directory

Whether you're troubleshooting a hardware failure or conducting a security investigation, it is essential to identify the last user who logged into a computer. This simple check saves hours of guesswork and helps you narrow down the cause.

Find computers’ last logon user in Active Directory using Event Viewer

Find who last logged-on to a specific Active Directory computer using PowerShell

Finding the last user of a specific computer via Event Viewer is time-consuming, as it requires editing the query and manually checking the first entry each time. To make this process more efficient, you can quickly find the user who last logged on to a specific computer using the PowerShell script below.

$computer = "<ComputerName>"
$lastLogon = Get-WinEvent -ComputerName $computer -FilterHashtable @{
    LogName = 'Security'
    Id      = 4624
} -MaxEvents 1000 |
ForEach-Object {
    [PSCustomObject]@{
        User      = $_.Properties[5].Value
        Domain    = $_.Properties[6].Value
        LogonType = $_.Properties[8].Value
        LogonTime = $_.TimeCreated
        Computer  = $computer
    }
} |  Sort-Object LogonTime -Descending | Select-Object -First 1
$lastLogon | Format-Table -AutoSize

Replace <TargetComputer> with the name of the computer you want to check. Once executed, the output displays the user who last logged on to the computer, along with their username, domain, and last logon timestamp.

Note: You can find the computer’s name using the following cmdlet. 

Get-ADComputer –Filter * | Format-Table 

Imagine a scenario where a user account being used across multiple devices starts showing signs of compromise. Your first instinct might be to update the password, but that change won’t take effect on devices where the account is still signed in. Forcing an immediate logoff may seem like the next step, but doing so could interrupt important tasks running on those machines. A safer approach is to first identify exactly where the account is currently active and then decide the appropriate action based on how and where the account is being used.

You can use the PowerShell script below to list all devices where the Active Directory user has active sessions.

$Username  = Read-Host "Enter username"
$UserCheck = Get-ADUser -Identity $Username -ErrorAction Stop
$Computers = Get-ADComputer -Filter "Enabled -eq 'true'" | Select-Object -Expand Name
foreach ($Computer in $Computers) {
    if (Test-Connection $Computer -Count 1 -Quiet) {
        $procs = Get-WmiObject Win32_Process -ComputerName $Computer 
        foreach ($p in $procs) {
            $owner = $p.GetOwner()       
            if ($owner.User -eq $Username) {
                Write-Host "$Username is logged on $Computer"
                Break
            }
        }
    }
}

Enter the username of the target user once you see the prompt. This retrieves the user’s currently logged-on system in Active Directory.

Domain controllers are the backbone of Active Directory as they handle logins, replicate data, and maintain the overall health of your environment. But when a domain controller sits unused for too long without any user activity, it becomes an easy target for attackers and increases the risk of compromise.

This is why it is important to identify unused DCs based on the users’ last logon time. With this insight, you can reduce security risks, clean up stale domain controllers, and keep your environment secure and well-maintained.

Check inactive domain controllers in Active Directory using PowerShell

You can use the PowerShell script given below to check whether users have logged in through a specific DC and pinpoint inactive domain controllers that haven't been logged in for about 90 days.

$DCs = Get-ADDomainController -Filter *
$InactiveDCs = @()
foreach ($DC in $DCs) {
    $Users = Get-ADUser -Filter { Enabled -eq $true } `
        -Properties LastLogonTimeStamp `
        -Server $DC.HostName
    $Recent = $Users | Where-Object {
        $_.LastLogonTimeStamp -ne 0 -and
        ([DateTime]::FromFileTime($_.LastLogonTimeStamp)) -gt (Get-Date).AddDays(-90)
    }
    if ($Recent.Count -eq 0) {
        $InactiveDCs += $DC.HostName
    }
}
if ($InactiveDCs.Count -gt 0) {
    "Inactive DCs with no user logons in 90 days:"
    $InactiveDCs
} else {
    "All domain controllers have recent user logons."
}

• Use AdminDroid’s inactive computers report to get a complete view of devices that haven't been logged in for a while, along with details like last logon date, OS details, version, service pack, status, and more.
• Select the Domain Controllers OU from the “Computer OU Name” built-in easy filter to view all inactive domain controllers in your environment.
• You can also adjust the ‘Last Logon Date and Time’ field to extend the inactivity duration as needed.

A user’s login history gives you a clear picture of how that account is being used. However, during any security investigations, retrieving login history on a specific computer shows logon times, flags unusual sign-ins, and helps verify whether activity aligns with expected behavior. These details are essential for confirming legitimate use and detecting potential misuse.

To get the logon history of a user on a computer, you can use the PowerShell script given below. Before executing, replace <UserName>, <ComputerName>, <StartDate>, and <EndDate> with the target user logon name, target computer, and the desired time range respectively.

$user = "<UserName>"
$computer = "<ComputerName>"
$startDate = "YYYY-MM-DD"
$endDate = "YYYY-MM-DD"
Get-WinEvent -ComputerName $computer -FilterHashtable @{
    LogName = 'Security'
    Id      = 4624, 4625, 4634, 4647, 4779
} -MaxEvents 1000 
Where-Object {
    $_.TimeCreated -ge (Get-Date $startDate) -and
    $_.TimeCreated -le (Get-Date $endDate) -and
    $_.Message -like "*$user*"
} |
Select-Object TimeCreated, Id, Message

When you run the script, it displays all logon activities performed by the target user on the selected computer, along with details such as the time created, event ID, and event description.