Windows Command net user output

Question

The command net user administrator, one of the output is the following:

Last logon 5/27/2017 2:31:17 PM

The system administrators have their own IDs when required to log on to this server. One suggested that it could be a scheduled task that was created and use the Administrator ID to run a task.

Could this be possible that a scheduled task reflect the last logon shown in the net user output? Thanks.

Answer 1

That can be either a scheduled task or a windows service that is configured to run under Administrator account. Check both.

Might be a remote connection from other server too.