Check When Users Last Logged On (Win32_NetworkLoginProfile)
List each local user's last logon time and logon count from PowerShell to see who has been using a shared PC.
Run `Get-CimInstance Win32_NetworkLoginProfile | Select-Object Name, LastLogon, NumberOfLogons` in an administrator PowerShell.
01Command
Command
$ Get-CimInstance Win32_NetworkLoginProfile | Select-Object Name, LastLogon, NumberOfLogons02What it does
On a family or office PC it can be useful to know whether an account was actually used recently. Windows tracks logon activity per account in the Win32_NetworkLoginProfile WMI class, which reports the last logon time and a running count of logons for each user profile known to the system. A quick query turns that into a tidy table without opening Event Viewer.
03Risk
!Warning: Some entries may show a raw number instead of a date for LastLogon — that is an unconverted Windows timestamp; accounts that never logged on interactively can appear with empty values.
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- Win32_NetworkLoginProfile class | Microsoft LearnEvidence: Win32_NetworkLoginProfile exposes LastLogon and NumberOfLogons for user accounts on the machine.
- Get-CimInstance cmdlet | Microsoft LearnEvidence: Get-CimInstance retrieves WMI class instances such as Win32_NetworkLoginProfile.
Last verified: 2026-09-19 · Category: System & Settings