0

Need to export a table with user names (samAcountNames) along with their last logon date\time on to specific server on network (who is a member of a domain).

According to google search, i can do it only as last logon date\time from domain controller, or from specific server but without user name or only last user's logon date\time.

In fact, i've found script which uses Security event log and must be launched on target server, but i am unable to kick off duplicates he produced:

UserName  : admin_le
LoginTime : 17.02.2015 15:36:04

UserName  : admin_le
LoginTime : 17.02.2015 15:36:04

UserName  : admin_le
LoginTime : 17.02.2015 15:36:04

UserName  : admin_le
LoginTime : 17.02.2015 15:36:00

UserName  : admin_le
LoginTime : 17.02.2015 15:36:00

UserName  : admin_le
LoginTime : 17.02.2015 15:36:00

UserName  : admin_le
LoginTime : 17.02.2015 15:36:00

Script itself:

$Date = [DateTime]::Now.AddDays(-14)
$Date.tostring("MM-dd-yyyy"), $env:Computername
$eventList = @()
Get-EventLog "Security" -After $Date `
| Where -FilterScript {$_.EventID -eq 4624 -and $_.ReplacementStrings[4].Length -gt 10 -and $_.ReplacementStrings[5] -notlike "*$"} `
| foreach-Object {
    $row = "" | Select UserName, LoginTime
    $row.UserName = $_.ReplacementStrings[5]
    $row.LoginTime = $_.TimeGenerated
    $eventList += $row
    }
$eventList > c:\export.log

Thanks.

1 Answer 1

0

Pipe $eventList out to sort -Property LoginTime -Unique.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .