"Last" or equiv for Windows login?

[Joe Smith]

"Bruce Dobrin" <dobrin@imageworks.com> wrote in message 
news:B7392353E4C4DE4ABC4EC255DB4CA04003471590@EXCHVS1.spimageworks.com...
Hi,

>Is there a flag for "last" or who or another program (cygwin or other)
>that shows me the current and/or previous Windows login user?  (Rather
>than the "last" cygwin shell login).  With a combination of cygwin tools
>and wmic  I have been able to log almost everything on any given remote
>machine...  But I can't figure out how to find out who is/was logged
>into the windows console (desktop or whatever you want to call it).  Any
>ideas?
>
>Thanks
>Bruce Dobrin

I assume you have the ability to install programs, and remotely run programs 
on the given remote machines.
You should be able to use a utility like Microsoft's logparser 
(http://www.logparser.com/) to do this.
Basically log parser allows you use SQL to search the event Log, among many 
other things.

logparser BLURB:
>Log parser is a powerful, versatile tool that provides universal query 
>access to text-based data such
>as log files, XML files and CSV files, as well as key data sources on the 
>Windows® operating system
> such as the Event Log, the Registry, the file system, and Active 
> Directory®. You tell Log Parser what
> information you need and how you want it processed. The results of your 
> query can be custom-formatted
> in text based output, or they can be persisted to more specialty targets 
> like SQL, SYSLOG, or a chart.
>
>Most software is designed to accomplish a limited number of specific tasks. 
>Log Parser is different...
>the number of ways it can be used is limited only by the needs and 
>imagination of the user. The world
> is your database with Log Parser.




--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/