Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im trying to obtain a list of users with their login time (n times if they have logged in more than once) in a particular timespan, for example between 2pm and 3pm on 10/10/2012.

I've been fiddling around with powershell, but couldn't get much out of it, downloaded the PowerShell extensions from Quest, tried out some snippets, but I couldn't find something that fits my needs.

My guess is to query the events on the Active Directory server but haven't been able to get a snippet that works so far.

share|improve this question

@ansgar is correct, AD only store the last logon time (lastlogontimestamp) for each account. If that suffices for you, here is a quick script that pulls the lastlogontimestamp value for each user:

$a = [adsisearcher]'(&(objectcategory=user)(objectclass=user))'
$a.PageSize = 1000
[void]$a.PropertiesToLoad.Add('name')
[void]$a.PropertiesToLoad.Add('lastlogontimestamp')
$a.FindAll() | ForEach-Object {
    $op = '' | select name,llts
    $op.name = $_.properties.name[0]
    if($_.properties.lastlogontimestamp)
    {
        $op.llts=[datetime]::fromfiletime($_.properties.lastlogontimestamp[0])
    }
    else
    {
        $op.llts=$null
    }
    $op
} | Format-Table -AutoSize
share|improve this answer

Active Directory only stores the timestamp of the last logon. For a logon history you will have to parse the Security eventlogs on all domain controllers for logon/logoff events. Beware of pitfalls while you do that.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .