On a recent KKE about custom inventories there was an example given.

ShellCommandTextReturn(wmic netlogin get Name, NumberOfLogons)


This command is supposed to return who all has logged into a targe machine and how many times.

I've talked to the teacher of the KKE (Ron Colson) and he says that command works correctly for him, but on my systems it seems to return wacky results. Below is what is returned on my machine.

C:\Users\jstrickland>wmic netlogin get Name, NumberOfLogons
Name                          NumberOfLogons
AFCUNT\pweatherton            12294
AFCUNT\ageorge                6825
AFCUNT\titaa                  65535
AFCUNT\jstrickland            65535

The users returned are correct, but the number of logons is wayyy off. Anywhere in our domain that my name pops up it says I've logged in 65535 times.

Anyone have any ideas about this?




Answer Summary:
2 Comments   [ + ] Show Comments


  • Also I should mention that I have logged into machines today and that 65535 hasn't changed, so I don't think it's a collective number of logons for the domain or anything like that.
  • that is the max number in the range
Please log in to comment

Community Chosen Answer


does it do the same thing at the command prompt?

wmic netlogin get Name, NumberOfLogons

Answered 05/29/2013 by: SMal.tmcc
Red Belt

  • Yes exact same results from command line.
Please log in to comment



I recently checked this: it works fine.

the 65535 looks like a maximum (2^16 -1) and you may overflown this one.

Esp if you use your system for a longer time this may happen. I have my new work notebook since 2 month and have already 129 logins there.

May be you logged more often and it has this max number.

Answered 05/30/2013 by: Nico_K
Red Belt

  • I found on the web the range for that entry is 1-65535 which is FF FF in hex
  • Ok I'll agree that's what it says, but everywhere my name shows up it has the 65535.
    Also the other users that show up on my machine when I run the command havn't logged in anywhere near that many times.

    Do you think it counts admin shares? Like someone admin sharing over to my machine?
    • It is kind if vague on the web where that entry is stored. I will keep digging around, have a feeling it is stored as a hex value.
  • Thanks very much for the help.
  • There is a laptop that I built yesterday, totally fresh Windows 7 install, and it has my number of logons as 65535.
    THere is just no way I logged in that many times in one day.
    • I have a feeling it is pulling that info from the domain.
  • Agreed, but it's ashame it's working like that.
    This would be a fairly neat tool in the bag.
Please log in to comment
Answer this question or Comment on this question for clarity
Admin Script Editor
Admin Script Editor is an integrated scripting environment available free here at ITNinja