Denied user shows recent logon time
We have a terminal server that is restricted to specific users via an
Active Directory group. One user had access, but back in March 2015,
his access was removed.
When I run Get-WmiObject -class Win32_NetworkLoginProfile |
Select-Object Name,LastLogon in PowerShell, that user is listed with a
date and time of today, but the user cannot login.
Why would they appear? Other users that have left the company and been
removed, show the last time they logged in.
Okay, so the users that left the company have the expected LastLogon
value where this "restricted" (but not terminated employee) account does not have the expected value when you run the PowerShell command.
When you run the Get-WmiObject -class Win32_NetworkLoginProfile
command, that is querying the network login values of the user which is not specific to a particular machine or server in the syntax you are using, so that would be the value of the last logon to the network onto any device with that account.
- To compare run
NET USER /DOMAIN <Username>
with that same username and you'll see the same date time stamp for the Last Logon
field as the WMI PowerShell commands, etc. in your question.
This explains why you see this, for the restricted, but not terminated account as that account is likely logging onto other domain-joined machines in your environment where the terminated accounts are not.
Below is a refined query with a little more specificity for a particular user account on a particular server or machine.
PowerShell Commands (refined)
# connecting to a remote machine using current identity:
$ComputerName = 'SomeServerNameOrIP'
$AccountName = 'AccountNameToSearch'
Get-WMIObject -Class Win32_NetworkLoginProfile -ComputerName $ComputerName |
Where {$_.name -match $AccountName} | Select-Object Name,LastLogon,LogonServer
Source: Win32_NetworkLoginProfile
Further Resources
Win32_NetworkLoginProfile
Win32_NetworkLoginProfile
The Win32_NetworkLoginProfile class represents the network login
information of a particular user on a Win32 system. This includes, but
is not limited to, password status, access privileges, disk quotas,
and login directory paths.
LastLogon
Data type DateTime
The LastLogon property indicates the date and time the user last logged on to > the system. This value is calculated
from the number of seconds elapsed since 00:00:00, January 1, 1970.
The format of this value is yyyymmddhhmmss.mmmmmm sutc. Example:
19521201000230.000000 000
WMIC - NETLOGON
NETLOGIN - Network login information for a particular user.