How to get the ORIGINAL logged in user

Question

We have a VBScript that pulls the username from HKCU\Volatile Environment\USERNAME. This is great except when running the script as an admin. Then this value changes to the admin username.

Where/how can I get the ORIGINAL username that was logged in? I can't get it from HKEY_CURRENT_USER because the ADMIN account get swapped in from HKEY_USERS.

https://stackoverflow.com/questions/22276361/how-to-get-username-with-vbs may be of some interest — Pankaj Jaju, Jul 18 '18 at 14:05
WMI should be able to help here, see [this link](https://stackoverflow.com/questions/34500290/find-user-logged-on-to-a-remote-computer). — user692942, Jul 19 '18 at 16:28

score 0 · Answer 1 · edited Jul 19 '18 at 16:25

0

I found it. I KNEW that the registry had to be hiding the last logged in user somewhere!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\ LastLoggedOnUser = ".\crewr"

Pull that string and just

replace( returnedRegString, ".\", "" )

and you're golden!

edited Jul 19 '18 at 16:25

user692942

16,398
7
76
175

answered Jul 18 '18 at 16:15

Crew Reynolds

27
6

How to get the ORIGINAL logged in user

1 Answers1