Batch file user's last logon using net user

Question

I'm using net user command in a batch script to find the last login time of a user :

net user administrator | findstr /B /C:"Last logon"

The result looks like this :

Last logon                   04/23/2020 9:02 AM

I would like to display the date and time only and remove Last logon

How can i achieve this ?

Thanks.

somebadhat · Answer 1 · 2020-04-24T00:35:17.140

Windows 10 64-bit. PowerShell 5

How to display the lastlogon timestamp for one / all local user accounts using CMD or Powershell. How to display the user name and / or date and / or time and / or hour. None of the commands require admin privileges.

PowerShell:

# How to display the lastlogon timestamp for one / all local user accounts.
# PowerShell 5. https://stackoverflow.com/a/61387391/8826818
# Interactive, searchable, gridview window. All accounts except default accounts named: DefaultAccount, Guest, WDAGUtilityAccount
get-localuser | where {$_.name -notmatch 'defaultaccount|guest|WDAGUtilityAccount'} | select-object lastlogon,name | out-gridview 
# All accounts except default accounts named: DefaultAccount, Guest, WDAGUtilityAccount  
get-localuser | where {$_.name -notmatch 'DefaultAccount|Guest|WDAGUtilityAccount'} | select-object lastlogon,name | format-table -hidetableheaders 
# All local accounts name, date and time. Remove name if not wanted.
$adsi = [ADSI]"WinNT://$env:COMPUTERNAME" 
$adsi.Children | where {$_.SchemaClassName -eq 'user'} | format-table lastlogin,name -HideTableHeaders 
# Account by name:
Get-LocalUser -Name Administrator,_9doug | Select-Object lastlogon,name | Format-Table -HideTableHeaders
# All accounts:
get-localuser | where {$_.name} | select-object lastlogon,name | format-table -hidetableheaders

Interactive, searchable gridview window:

Or:

Administrator 4/12/2020 7  :  32  :  09 PM
_7doug        11/18/2019 11  :  13  :  53 PM
_8doug        10/25/2019 4  :  47  :  09 PM
_9doug        4/23/2020 6  :  49  :  41 AM

CMD:

rem date and time
for /f "tokens=2,*" %g in ('net user administrator ^| findstr /C:"Last logon"') do echo %h
rem only the hour 
for /f "tokens=4" %g in ('net user administrator ^| findstr /C:"Last logon"') do echo Last logon hour was: %g

Script:

rem date and time
for /f "tokens=2,*" %%g in ('net user administrator ^| findstr /C:"Last logon"') do echo %%h
rem only the hour 
for /f "tokens=4" %%g in ('net user administrator ^| findstr /C:"Last logon"') do echo Last logon hour was: %%g

Unusual output of net user command:

For

QUSER: Only works for current user.

CMD:

rem date and time
for /f "skip=1 tokens=6-8" %g in ('quser administrator') do echo %g %h %i
rem only the hour 
for /f "skip=1 tokens=7 delims=: " %g in ('quser administrator') do echo Last logon hour was: %g

Script:

rem date and time
for /f "skip=1 tokens=6-8" %%g in ('quser administrator') do echo %%g %%h %%i
rem only the hour 
for /f "skip=1 tokens=7 delims=: " %%g in ('quser administrator') do echo Last logon hour was: %%g

`for /f "tokens=2,*" %g in ('net user administrator ^| findstr /B /C:"Last logon"') do echo %h` for full date-time-stamp — Stephan, Apr 23 '20 at 12:42
@ste Could you look at the inline image in my answer and tell me: "how can I display the info without the `?` question marks and `|+` characters?" — somebadhat, Apr 23 '20 at 13:03
so it's not just my computer... Sorry, I have no idea besides removing them with `set` substring manipulation. — Stephan, Apr 23 '20 at 13:27
If I want to keep the hour only and remove the timestamp. What would be the command ? — Cospuser, Apr 23 '20 at 15:02

Compo · Accepted Answer · 2020-04-23T15:54:39.643

You could optionally use WMI for this task, which should provide you with a date and time string which is universally parseable.

If you want a specific user:

@Set "UsersName=Administrator"
@For /F Tokens^=2^,4Delims^=^" %%G In ('%__AppDir__%wbem\WMIC.exe UserAccount^
 Where "Name='%UsersName%'" Assoc /AssocClass:Win32_NetworkLoginProfile 2^>NUL'
)Do @For /F %%I In ('%__AppDir__%wbem\WMIC.exe Path Win32_NetworkLoginProfile^
 Where "Name='%%G\\%%H' And LastLogon Is Not Null" Get LastLogon 2^>NUL^
 ^|%__AppDir__%findstr.exe "[0123456789]"')Do @Echo %%H last logon was %%~nI
@Pause

Alternatively if you want a listing of users:

@For /F Tokens^=2^,4Delims^=^" %%G In ('%__AppDir__%wbem\WMIC.exe UserAccount^
 Assoc /AssocClass:Win32_NetworkLoginProfile 2^>NUL')Do @For /F %%I In (
    '%__AppDir__%wbem\WMIC.exe Path Win32_NetworkLoginProfile Where^
     "Name='%%G\\%%H' And LastLogon Is Not Null" Get LastLogon 2^>NUL^
     ^|%__AppDir__%findstr.exe "[0123456789]"')Do @Echo %%H last logon was %%~nI
@Pause

[Edit /?]
Based upon the question you've asked in comment to another answer, and because I've already indicated that my solution(s) above provide a universally parseable date and time format, you can further adapt it to output only the hour.

For example:

@For /F Tokens^=2^,4Delims^=^" %%G In ('%__AppDir__%wbem\WMIC.exe UserAccount^
 Assoc /AssocClass:Win32_NetworkLoginProfile 2^>NUL')Do @For /F %%I In (
    '%__AppDir__%wbem\WMIC.exe Path Win32_NetworkLoginProfile Where^
     "Name='%%G\\%%H' And LastLogon Is Not Null" Get LastLogon 2^>NUL^
     ^|%__AppDir__%findstr.exe "[0123456789]"')Do @(Set "YYYYmmDDHHMMSS=%%~nI"
     Call Echo(%%H last logged in during the hour of %%YYYYmmDDHHMMSS:~-6,2%%:00)
@Pause

Of course, this does not identify on which day that logon occurred, but your additional requirement was specific!

Batch file user's last logon using net user

2 Answers2