Windows 8

Display Last Logged On Information for Windows 8.1

Think about this scenario for a moment: Imagine that your network security has been compromised, and you have a good reason to believe that someone obtained your logon credentials. Or maybe they’re trying to logon with your user account by guessing your password. Such activity is not something you want to go unnoticed, and you would probably want to be informed about it as soon as possible.

In a previous article I showed you how to display the last interactive logon information in Windows Server 2008 and Windows Server 2012. In this article, I’ll show you how to get the same type of information on your personal computer, one that is not joined to any Active Directory domain. This feature actually works since the days of Windows Vista and Windows 7, and the same feature continues to work with Windows 8 and 8.1.

Display last logged information for Windows 8
Displaying last logged information can help improve IT security or help recover from a breach. (Image: Dreamstime)

Note: This tip is intended to be used in a Active Directory domain environment. It will not work for stand-alone workstations that you typically use at home.

Sponsored Content

What is “Inside Microsoft Teams”?

“Inside Microsoft Teams” is a webcast series, now in Season 4 for IT pros hosted by Microsoft Product Manager, Stephen Rose. Stephen & his guests comprised of customers, partners, and real-world experts share best practices of planning, deploying, adopting, managing, and securing Teams. You can watch any episode at your convenience, find resources, blogs, reviews of accessories certified for Teams, bonus clips, and information regarding upcoming live broadcasts. Our next episode, “Polaris Inc., and Microsoft Teams- Reinventing how we work and play” will be airing on Oct. 28th from 10-11am PST.

Two Ways to Display Last Logged Information on Windows 8/8.1

There are two different ways to display last logged on information for Windows 8 and 8.1, which include using local group policy and editing the local Windows registry.

Method 1: Using Local Group Policy

1. Log in to the computer using administrative credentials.

2. Press Win+R keys on your keyboard and type “gpedit.msc” (no quotes) into the “Run” dialog box. Click Enter. If you are prompted by UAC, click Yes.

3. In the Group Policy Editor window, browse to:

Computer Configuration > Administrative Templates > Windows Components > Windows Logon Options

4. Double-click on the “Display information about previous login during user login” setting.

Display information about previous login during user login
Displaying information about previous login during user login. (Image: Daniel Petri)
Enabling last logged on information in Windows 8.1. (Image: Daniel Petri)
Enabling Windows to display last logged on information. (Image: Daniel Petri)

5. In the setting window click “Enabled,” then click on “Ok”.

6. Close the Group Policy Editor.

7. Press Win+R keys on your keyboard and type “gpupdate /force” (no quotes) into the “Run” dialog box. Click Enter.

Forcing a group policy update using the Run dialog.
Forcing a group policy update using the Run dialog. (Image: Daniel Petri)

Log off from the current Windows session and logon back in to test.

Method 2: Using the Local Registry

Warning! Edit the registry with care, and do so at your own risk. Always back up the registry before making changes. If you make mistakes or introduce errors, you may not be able to boot the Windows PC with the edited registry. If you don’t feel comfortable editing the registry yourself, find an experienced Windows system administrator to help you complete this task safely.

1. Log in to the computer using administrative credentials.

2. Press Win+R keys on your keyboard and type “regedit.exe” (no quotes) into the “Run” dialog box. Click Enter. If you are prompted by UAC, click Yes.

3. In the Registry window, browse to:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem

4. Create a new DWORD value named “DisplayLastLogonInfo” (no quotes).

Creating a new DWORD valued named "DisplayLastLogonInfo" in the Windows registry.
Creating a new DWORD valued named “DisplayLastLogonInfo” in the Windows registry. (Image: Daniel Petri)

5. Set the “to “1” (no quotes).

Editing the "DisplayLastLogonInfo" value in the Windows registry.
Editing the “DisplayLastLogonInfo” value in the Windows registry. (Image: Daniel Petri)

Note: If you already have such a value, then just set it to 1 to enable the last logon information. Log off from the current Windows session and log back in to test.

Related Topics:

BECOME A PETRI MEMBER:

Don't have a login but want to join the conversation? Sign up for a Petri Account

Register
Comments (0)

Leave a Reply

External Sharing and Guest User Access in Microsoft 365 and Teams

This eBook will dive into policy considerations you need to make when creating and managing guest user access to your Teams network, as well as the different layers of guest access and the common challenges that accompany a more complicated Microsoft 365 infrastructure.

You will learn:

  • Who should be allowed to be invited as a guest?
  • What type of guests should be able to access files in SharePoint and OneDrive?
  • How should guests be offboarded?
  • How should you determine who has access to sensitive information in your environment?

Sponsored by: