The Process Name identifies the program executable that accessed the object. Process ID is the process ID specified when the executable started as logged in 4688. Option Explicit Dim objWMIService, colItems, WshNetwork, strComputer Dim objUser, objItem, dtmLastLogin.

Copy the following lines of code to Notepad, and save the file as lastlogon.vbs. Handle ID allows you to correlate to other events logged (Open 4656, Access 4663, Close 4658) Here is a VBScript that I came up with, that displays the last login date/time details for each local user account on the computer.

Hanlde ID: is a semi-unique (unique between reboots) number that identifies all subsequent audited events while the object is open.

Object Value Name: The name of the registry value within the key that is being accessed.

Object Name: The name of the registry key being accessed.

This is the registry key and value upon whom the action was attempted. Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session.

Logon ID is a semi-unique (unique between reboots) number that identifies the logon session.

Account Domain: The domain or - in the case of local accounts - computer name.

TIP : This post will show you how to hide your email address in Windows 10 Lock Screen, using Group Policy or Registry.

The user and logon session that performed the action. If this policy is disabled, the name of the last user to log on is displayed. On remote computers, it is imperative to check for unauthorized logons to protect the network from potential. AutoAdminLogon relies on the DefaultUserName entry to match the user and password. A system administrator would need to track users last logon date and time to identify stale accounts, if any, in the organizations Active Directory. An interactive console logon that has a different user on the server changes the DefaultUserName registry entry as the last logged-on user indicator.

Free Active Directory Change Auditing Solution How to generate and export the last logged on users on remote computers report.

Windows Event Collection: Supercharger Free Edtion.

Free Security Log Quick Reference Chart.

Of course this event will only be logged if the key's audit policy is enabled for Set Value permission for the appropriate user or a group in the user is a member. See Operation Type to find out if the value was created, modified or deleted. This event is logged between the open ( 4656) and close ( 4658) events for the registry KEY where the value resides.

This event documents creation, modification and deletion of registry VALUES.

Last logged on user registry