Pull cache of last logged on users?

Hey guys, In school I need to prove someone was logged onto a certain station. I know the login is cached but I have no idea how to extract it. Does anyone know how I can get the last few usernames of people who logged on?

Its in the registry somewhere isnt it?
Thanks

you can enabled auditing for successful logins and logoffs. Set event viewer not to overwrite logs. This will allow you to see the events.

Except I need to see it now, its already been done. Is there a way to check who logged on which is enabled by default?

Did you enable logging in verbose mode in the policy? Did you check the event viewer security log. This is where it should be if enabled.