One of the questions that is frequently asked in a large organization is, “Who uses computer XYZ123?”. Many tools will report the current user, but the current user may or may not be the the person who usually works on a given computer. The current user for the computer you are logged on logged onto to fix is probably not the name you want.
In pre-Windows 7 days, I used to pull the user information from the registry location HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName. I recently found out that this has been moved to HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\LastLoggedOnUser for Windows 7.
Unfortunately when I went looking in the new location, there was nothing there. The missing LastLoggedOnUser was a weird problem. After some Google search time I found that if you use a GPO entry to clear the last username then LastLoggedOnUser is not populated.
I then spent some time with WMI, and found some interesting information is available in Win32_NetworkLoginProfile. I ended up writing two scripts: LastUserLogon.vbs gets the last user for a computer, and TopComputerUsers.vbs (pulled, see below) which collects the top 5 interactive logons for a computer. Both let you copy the data to the clipboard if Word is installed, otherwise the information can be output to notepad.
The TopComputerUsers script is interesting because WMI contains a count of user logons, and I use a disconnected recordset to sort the user information by number of logons. The LastUserLogon gives you a subset of the information from TopComputerUsers, and can help you determine whether a given computer is underutilized.
Both will work on local or remote computers. Both take a computer name as an argument. And both scripts tell you who the current user is.
Unfortunately the data TopComputerUsers.vbs returns is BOGUS. The total number of logons is not returned (or maintained) by the local machine, but rather reports the logons to the domain. See: http://msdn.microsoft.com/en-us/library/aa394221(VS.85).aspx. You can, however use it for the most recent logon, so the other script is okay.