Share via

Inaccurate LastUseTime attribute in Win32_Userprofile CIM class on Windows 10 endpoints

Elise Whitethorn 20 Reputation points
2026-05-13T15:59:13.4833333+00:00

Hello,

We are reported with inconsistent telemetry regarding workstation utilization due to a discrepancy in how the operating system tracks account activity. While executing the Get-CimInstance cmdlet to audit the Win32_UserProfile class, we have observed that the LastUseTime timestamp fails to reflect actual recent login events, instead returning stale or erroneous chronological data for every local and domain profile on the machine. We're looking for a technical explanation for this lack of synchronization between the WMI repository and the actual filesystem or registry hive activity, along with a more reliable alternative for determining the true final authentication timestamp on a Windows 10 endpoint. Thank you so much.

Windows for business | Windows 365 Enterprise
0 comments

Answer accepted by question author

  1. VPHAN 31,830 Reputation points Independent Advisor
    2026-05-15T09:10:44.5666667+00:00

    Hi Elise Whitethorn,

    How is your issue going? Has it been resolved yet? If it has, please consider accepting the answer as it helps others sharing the same problem benefit too. Thank you :)

    VPHAN

    Was this answer helpful?

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. VPHAN 31,830 Reputation points Independent Advisor
    2026-05-13T16:37:06.2466667+00:00

    Hi Elise Whitethorn,

    The synchronization discrepancy you are experiencing occurs because the Windows User Profile Service updates metadata inside the registry path HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\<SID> whenever a user hive file, NTUSER.DAT, is accessed. The Win32_UserProfile WMI class reads directly from these registry structures. Because automated system processes like background updates, security scans, or backup agents regularly mount these hives to perform maintenance, they update the modification timestamps without an actual interactive user logon occurring. This architecture makes WMI completely unreliable for tracking physical workstation utilization.

    To establish an accurate timeline, you must bypass the WMI repository entirely and query the raw auditing data stored within the dedicated security event log file located at %SystemRoot%\System32\Winevt\Logs\Security.evtx. The definitive method for verifying human interaction is targeting Event ID 4624, which tracks successful account logons. Within this log, you must isolate specific authentication contexts using the Logon Type attribute. You need to focus on Logon Type 2 for physical console logons, Logon Type 7 for workstation unlock events, and Logon Type 10 for Remote Desktop connections. Extracting the latest timestamp bound to these specific logon types filters out background system noise and provides the true, precise utilization data you require.

    Hope this answer brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

    VPHAN

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.