[Borland]

Например - вот таким скриптом.

'///////////////////////////////////////////////////////////////
'Name: LogonInfo.vbs
'Author: Jamie Nelson
'Version: 1.0
'Purpose: Get logon session information for current user.
'-----------Date--------Version-----ChangeLog-------------------
'History:       8/6/2007        1.0                     Initial code developed.
'///////////////////////////////////////////////////////////////

'Option Explicit
On Error Resume Next

'===============================================================
'Declare variables, instantiate common script objects
'===============================================================

Const ForReading = 1, ForWriting = 2, ForAppending = 8

Dim wsh : Set wsh = CreateObject("WScript.Shell")
Dim wsn : Set wsn = CreateObject("WScript.Network")
Dim fso : Set fso = CreateObject("Scripting.FileSystemObject")

'===============================================================
'Begin Execution of Script
'===============================================================

Dim objWMI, colLogonSessions, colSessionProcesses
Set objWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
Dim strSessionId, dtmSessionStart, intLogonType

Dim strDomain : strDomain = wsn.UserDomain
Dim strUser : strUser = wsn.UserName

'// Get session id's for current user (can be multiple ones)
Set colLogonSessions = objWMI.ExecQuery("ASSOCIATORS OF " & _
        "{Win32_Account.Domain=""" & strDomain & """,Name=""" & strUser & """} " & _
        "WHERE AssocClass=Win32_LoggedOnUser Role=Antecedent")
        
'// Iterate through the session id's
For Each objLogonSession In colLogonSessions
        Select Case objLogonSession.LogonType
                '// We only want LogonType of Interactive (2) or RemoteInteractive (10)
                Case 2, 10
                        '// Ensure we only have the 'current' session id since earlier 'stale' sessions for the user may still be present
                        Set colSessionProcesses = objWMI.ExecQuery("ASSOCIATORS OF " & _
                        "{Win32_LogonSession.LogonId=" & objLogonSession.LogonId & "} " & _
                        "WHERE AssocClass=Win32_SessionProcess Role=Antecedent")
                        If colSessionProcesses.Count > 0 Then
                                strSessionId = objLogonSession.LogonId
                                dtmSessionStart = WMIDateStringToDate(objLogonSession.StartTime)
                                intLogonType = objLogonSession.LogonType
                                Exit For
                        End If
                Case 11, 12
                        '// Reserved for future use. These LogonTypes identify cached interactive logons.
                Case Else
                        '// We only care about interactive logons. Do nothing.
        End Select
Next

Set colSessionProcesses = Nothing
Set colLogonSessions = Nothing
Set objWMI = Nothing

MsgBox _
        "Username: " & strUser & vbCRLF & _
        "Domain: " & strDomain & vbCRLF & _
        "LastLogon: " & dtmSessionStart & vbCRLF & _
        "LogonType: " & intLogonType & vbCRLF & _
        "SessionID: " & strSessionID, 0 + 64, "Logon Information"

'===============================================================
'Clear variables, terminate script
'===============================================================

Set wsh = Nothing
Set wsn = Nothing
Set fso = Nothing

WScript.Quit

'===============================================================
'Declare procedures/functions/classes
'===============================================================

'--------------------
Function WMIDateStringToDate(dtDate)
'--------------------
'Returns a WMI formated date as a variant of subtype date.

On Error Resume Next

WMIDateStringToDate = CDate(Mid(dtDate, 7, 2) & "/" & _
        Mid(dtDate, 5, 2) & "/" & Left(dtDate, 4) _
        & " " & Mid (dtDate, 9, 2) & ":" & Mid(dtDate, 11, 2) & ":" & Mid(dtDate,13, 2))
End Function

Потырено тут: http://www.freelists.org/post/gptalk/Xp-display-last-login-time,3
Проверено на работоспособность, изменён формат вывода даты с MM.DD.YYYY на DD.MM.YYYY