Jason Yoder, MCT

Yesterday on PowerShell.com, I had the opportunity to help an IT Pro pull the last logged on user from every one of their client machines.  What we discovered is that there are two places in the registry that hold this information.  For the last local account, we extracted the name from: HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUsername For the last domain user: HKLM:\Software\Microsoft\windows\currentVersion\Authentication\LogonUI\LastLoggedOnUser Just to add a little, and since it was right there, here is the last SID: HKLM:\Software\Microsoft\windows\currentVersion\Authentication\LogonUI\LastLoggedOnUserSid To do this one at a time would have been to time consuming.  Also, what about the clients that were not online?  How are you going to record them?  Sitting in my Windows Server 2012 R2 class right now is an IT Pro with over 70,000 clients.  This would have been a nightmare to perform manually.  I am estimating tha...