Need to export a table with user names (samAcountNames) along with their last logon date\time on to specific server on network (who is a member of a domain).
According to google search, i can do it only as last logon date\time from domain controller, or from specific server but without user name or only last user's logon date\time.
In fact, i've found script which uses Security event log and must be launched on target server, but i am unable to kick off duplicates he produced:
UserName : admin_le
LoginTime : 17.02.2015 15:36:04
UserName : admin_le
LoginTime : 17.02.2015 15:36:04
UserName : admin_le
LoginTime : 17.02.2015 15:36:04
UserName : admin_le
LoginTime : 17.02.2015 15:36:00
UserName : admin_le
LoginTime : 17.02.2015 15:36:00
UserName : admin_le
LoginTime : 17.02.2015 15:36:00
UserName : admin_le
LoginTime : 17.02.2015 15:36:00
Script itself:
$Date = [DateTime]::Now.AddDays(-14)
$Date.tostring("MM-dd-yyyy"), $env:Computername
$eventList = @()
Get-EventLog "Security" -After $Date `
| Where -FilterScript {$_.EventID -eq 4624 -and $_.ReplacementStrings[4].Length -gt 10 -and $_.ReplacementStrings[5] -notlike "*$"} `
| foreach-Object {
$row = "" | Select UserName, LoginTime
$row.UserName = $_.ReplacementStrings[5]
$row.LoginTime = $_.TimeGenerated
$eventList += $row
}
$eventList > c:\export.log
Thanks.