How to find last login user on given computer name on AD
Look in the Security Event Log on those machines. There will be all logon events audited there.
You can filter the logs for event 528. The logon type that you're looking for in those events is 2
, which is an interactive logon.
The registry key, that MDMarra is referring to should be HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI (assuming later than XP). Look in LastLoggedOnUser.
Create a login script that logs usernames and dates for each machine on a network share. For example, append %username% and %date% information to the file %computername%.txt Then whenever you have a question about who logged into a computer, it should be in chronological order in the file.