1

We have a terminal server that is restricted to specific users via an Active Directory group. One user had access, but back in March 2015, his access was removed.

When I run Get-WmiObject -class Win32_NetworkLoginProfile | Select-Object Name,LastLogon in PowerShell, that user is listed with a date and time of today, but the user cannot login.

Why would they appear? Other users that have left the company and been removed, show the last time they logged in.

1 Answer 1

1

Denied user shows recent logon time

We have a terminal server that is restricted to specific users via an Active Directory group. One user had access, but back in March 2015, his access was removed.

When I run Get-WmiObject -class Win32_NetworkLoginProfile | Select-Object Name,LastLogon in PowerShell, that user is listed with a date and time of today, but the user cannot login.

Why would they appear? Other users that have left the company and been removed, show the last time they logged in.

Okay, so the users that left the company have the expected LastLogon value where this "restricted" (but not terminated employee) account does not have the expected value when you run the PowerShell command.

When you run the Get-WmiObject -class Win32_NetworkLoginProfile command, that is querying the network login values of the user which is not specific to a particular machine or server in the syntax you are using, so that would be the value of the last logon to the network onto any device with that account.

  • To compare run NET USER /DOMAIN <Username> with that same username and you'll see the same date time stamp for the Last Logon field as the WMI PowerShell commands, etc. in your question.

This explains why you see this, for the restricted, but not terminated account as that account is likely logging onto other domain-joined machines in your environment where the terminated accounts are not.


Below is a refined query with a little more specificity for a particular user account on a particular server or machine.

PowerShell Commands (refined)

# connecting to a remote machine using current identity:
$ComputerName = 'SomeServerNameOrIP'
$AccountName  = 'AccountNameToSearch'
Get-WMIObject -Class Win32_NetworkLoginProfile -ComputerName $ComputerName |
Where {$_.name -match $AccountName} | Select-Object Name,LastLogon,LogonServer

Source: Win32_NetworkLoginProfile


Further Resources

Win32_NetworkLoginProfile

Win32_NetworkLoginProfile

The Win32_NetworkLoginProfile class represents the network login information of a particular user on a Win32 system. This includes, but is not limited to, password status, access privileges, disk quotas, and login directory paths.

LastLogon

Data type DateTime

The LastLogon property indicates the date and time the user last logged on to > the system. This value is calculated from the number of seconds elapsed since 00:00:00, January 1, 1970. The format of this value is yyyymmddhhmmss.mmmmmm sutc. Example: 19521201000230.000000 000

WMIC - NETLOGON

  • NETLOGIN - Network login information for a particular user.
5
  • Been on vacation, will test this out today.... looks good thanks! Jan 11, 2016 at 9:15
  • @neildeadman Did you determine anything with this by chance? Just curious on an update. Jan 14, 2016 at 21:25
  • Sorry, never saw your reply..... I get values for the active users, but disabled users do not give a response. I guess maybe because they've been inactive for a while?? Jan 25, 2016 at 10:26
  • @neildeadman I'm not 100% where this Win32_NetworkLoginProfile class is getting the information but if it's on the local machine then the local machine probably doesn't keep the history of this detail cached so if it's been a while that may be the case. You could sign on with a test account, query the machine, confirm the detail is there, disable that account, and then query again to see the results. Jan 25, 2016 at 13:48
  • @neildeadman I'm not famliar with the inner workings of this class either but others with some Gogle searches suggest this if it gets the information from a DC rather than the local machine I think: The class is designed to go first to the Domain Controller, and next to the Logon Server (in case the first call to NetUserGetInfo fails). The most autorityve source first. Try to get the same information through ADSI Jan 25, 2016 at 13:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .