Finding the Last User Logged On

The FTK User manual, and Irongeek say that you can find the name of the user who last logged on in the Registry at:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

On Windows XP, the name appears in the DefaultUserName value:

But on my Windows 7, the DefaultUserName value is absent:

This has been noticed before. That person says it works sometimes and fails other times.

I don't know why it's absent. Even creating a second user, logging out, and logging back in with the other name did not make it appear.


Written by Sam Bowne, 5 pm 2-7-2012