How to find what user last logged onto a given computer through Active Directory in C#?

Question

I am trying to programmatically find who last logged onto a given computer and when with C#. Given the name of a computer as a string, I have learned about Getting last Logon Time on Computers in Active Directory. However, there doesn't seem to be a property for which user was the one that actually logged in. Do I have to take a different approach for this? Anything I found online that was remotely related to this was in VBScript, but this must be done in C#.

Answer 1

Simply query the necessary information from the System Registry. The following method will set the Registry View based on whether the machine is 64-bit or 32-bit - although if you're doing this remotely - then the approach to obtain this information may need to be altered, but the general approach should be the same.

The Base Key is selected using the name of the machine that you pass an argument along with the Registry View and of course the Registy Hive as Local Machine. Then you open up the Base Key and finally the necessary Sub Key where the information you desire resides.

The location where that information is contained is:

SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI

And from there grab the value from LastLoggedOnUser.

Here is the code in C#:

private static string GetLastUserLoggedOn(string machineName)
{
    string location = @"SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI";
    var registryView = Environment.Is64BitOperatingSystem ? RegistryView.Registry64 : RegistryView.Registry32;
    using (var hive = RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, machineName, registryView))
    {
        using (var key = hive.OpenSubKey(location))
        {
            var item = key.GetValue("LastLoggedOnUser");
            string itemValue = item == null ? "No Logon Found" : item.ToString();
            return itemValue;
        }
    }
}

Answer 2

Here is some code I found:

using System;            
    // has DateTime class
using System.Collections.Generic;    
    // has the Dictionary class
using System.DirectoryServices;    
    // has all the LDAP classes such as DirectoryEntry 
using ActiveDs;            
    // has the IADsLargeInteger class


// Get the root entry
DirectoryEntry rootDSE = new DirectoryEntry("LDAP://RootDSE");
string configurationNamingContext = 
    (string)rootDSE.Properties["configurationNamingContext"].Value;
string defaultNamingContext = 
    (string)rootDSE.Properties["defaultNamingContext"].Value;
// Get all the domain controllers


// Get all the domain controllers
DirectoryEntry deConfig = 
    new DirectoryEntry("LDAP://" + configurationNamingContext);
DirectorySearcher dsConfig = new DirectorySearcher(deConfig);
dsConfig.Filter = "(objectClass=nTDSDSA)";
foreach (SearchResult srDomains in dsConfig.FindAll()) 
{
    DirectoryEntry deDomain = srDomains.GetDirectoryEntry();
    if (deDomain != null) 
    {
        string dnsHostName = 
            deDomain.Parent.Properties["DNSHostName"].Value.ToString();
        // Get all the users for that domain
    }
}


// Get all the users for that domain
DirectoryEntry deUsers = 
    new DirectoryEntry("LDAP://" + dnsHostName + "/" + defaultNamingContext);
DirectorySearcher dsUsers = new DirectorySearcher(deUsers);
dsUsers.Filter = "(&(objectCategory=person)(objectClass=user))";
foreach (SearchResult srUsers in dsUsers.FindAll()) 
{
    DirectoryEntry deUser = srUsers.GetDirectoryEntry();
    if (deUser != null) 
    {
        // Get the distinguishedName and lastLogon for each user
        // Save the most recent logon for each user in a Dictionary object
    }
}

//Create Dictionary
Dictionary<string, Int64> lastLogons = new Dictionary<string, Int64>();


// Get the distinguishedName and lastLogon for each user
string distinguishedName = 
    deUser.Properties["distinguishedName"].Value.ToString();
Int64 lastLogonThisServer = new Int64();
if (deUser.Properties["lastLogon"].Value != null) 
{
    IADsLargeInteger lgInt = 
        (IADsLargeInteger)deUser.Properties["lastLogon"].Value;
    lastLogonThisServer = ((long)lgInt.HighPart << 32) + lgInt.LowPart;
}

// Save the most recent logon for each user in a Dictionary object
if (lastLogons.ContainsKey(distinguishedName)) 
{
    if (lastLogons[distinguishedName] < lastLogonThisServer) 
    {
        lastLogons[distinguishedName] = lastLogonThisServer;
    }
} 
else 
{
    lastLogons.Add(distinguishedName, lastLogonThisServer);
}


//Get the time
// Convert the long integer to a DateTime value
string readableLastLogon = 
    DateTime.FromFileTime(lastLogonThisServer).ToString();

Here is the website where all of this code came from. The developer explained the code in detail. http://www.codeproject.com/Articles/19181/Find-LastLogon-Across-All-Windows-Domain-Controlle