2

I have a script which gets the last logon times of each computer in the domain.

My script:

$dcs = Get-ADComputer -Filter { OperatingSystem -NotLike '*Server*' } -Properties OperatingSystem

foreach($dc in $dcs) { 
    Get-ADComputer $dc.Name -Properties lastlogontimestamp | 
    Select-Object @{n="Computer";e={$_.Name}}, @{Name="Lastlogon"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}}
}

==================================

Result:

Computer Lastlogon
-------- ---------
DC1 6/06/2013 16:38:24
DC2 6/06/2013 16:30:40

=============================================

I also want to get who/which account made this logon. For example:

Computer Lastlogon User
-------- ------------------ ----
DC1 6/06/2013 16:38:24 user2
DC2 6/06/2013 16:30:40 user1

3 Answers 3

3

This one might not be perfect but it will get you on the right track. To get the exact last user, please see this script. It will give you further information on how to filter the exact last user. In the below example, I have used, select-object -First 1 which should be a pretty good indicator of the last logged on user. To get the last logged on user, you need to use

Get-WmiObject -Class Win32_UserProfile

To 'join' the Get-ADComputer and Get-WMIObject information, I have used a Hash Table.

If you are running this from a Domain Administrator account, you can take the -credential $credential part out. Otherwise, leave it in and you can run it from a normal workstation with the RSAT tools installed so Get-ADComputer is available.

Code below:

$computers = Get-ADComputer -Filter { OperatingSystem -NotLike '*Server*' } -Properties OperatingSystem
$credential = Get-Credential -Message "Please enter your administrator username and password"

foreach($computer in $computers) { 
    $pcinfo = Get-ADComputer $computer.Name -Properties lastlogontimestamp | ` 
              Select-Object @{Name="Computer";Expression={$_.Name}}, ` 
             @{Name="Lastlogon";Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}}

    $lastuserlogoninfo = Get-WmiObject -Class Win32_UserProfile -ComputerName $computer.name -Credential $credential | Select-Object -First 1
    $SecIdentifier = New-Object System.Security.Principal.SecurityIdentifier($lastuserlogoninfo.SID)
    $username = $SecIdentifier.Translate([System.Security.Principal.NTAccount])

    # Create hashtable for properties
    $properties = @{'Computer'=$pcinfo.Computer;
                    'LastLogon'=$pcinfo.Lastlogon;
                    'User'=$username.value
                   } #end $properties
    write-output (New-Object -Typename PSObject -Property $properties)
}

Check the formatting when you use it. Some of it I had to add in an escape (`) character to fit it into the script window.

Thanks, Tim.

6
  • Does not work, the Expression before datetime is marked read in VS Code.
    – Timo
    Oct 29, 2019 at 13:46
  • 1
    Thanks for pointing this out @Timo. Have updated with = . Should work now. Updating via mobile though so haven’t yet tested. Thanks, Tim.
    – Tim Haintz
    Oct 30, 2019 at 7:54
  • Maybe one curly brace is too much: lastLogonTimestamp)}}. One curly brace would be enough?
    – Timo
    Oct 30, 2019 at 15:05
  • And: I am admin, so left the credential part out, but : $username = $SecIdentifier.Translate([System.Security.Principal.N …. Ausnahme beim Aufrufen von "Translate" mit 1 Argument(en): "Manche oder alle Identit�tsverweise konnten nicht �bersetzt werden.". Sorry for the german, there seems a Problem with translate.
    – Timo
    Oct 30, 2019 at 15:11
  • Hi again @Timo I needed to add another curly brace just after the =. From docs.microsoft.com/en-us/powershell/module/… - Example 10 - uses calculated properties. Sorry for any hassle this has caused. Thanks, Tim.
    – Tim Haintz
    Oct 30, 2019 at 17:25
1

Not to burst everyone's bubble, but the "LastUseTime" field under Win32_UserProfile is NOT last Login; it's simply the last timestamp the "Profile" was updated (for any reason). You will find ALL profiles updated periodically for various reasons--installers, policy updates, etc.

Also, the data is not ordered by default, so the "-First 1" argument is not useful unless the data is first sorted by "LastUseTime"--which again is worthless due to above.

I hate to say that the above scripts are not providing any useful data for "Last Logon".

0

This is Tim's Code and I updated it in order to display computer ip address & operating system, and export data.

 $computers = Get-ADComputer -Filter { OperatingSystem -NotLike '*Server*'} -Properties OperatingSystem

 foreach($computer in $computers) { 
     $pcinfo = Get-ADComputer $computer.Name -Properties ipv4Address, OperatingSystem ,lastlogontimestamp | 
               Select-Object @{n="Computer";e={$_.Name}}, 
              @{Name="Lastlogon";Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},ipv4Address,OperatingSystem

     $lastuserlogoninfo = Get-WmiObject -Class Win32_UserProfile -ComputerName $computer.name -Credential $credential | Select-Object -First 1
     $SecIdentifier = New-Object System.Security.Principal.SecurityIdentifier($lastuserlogoninfo.SID)
     $username = $SecIdentifier.Translate([System.Security.Principal.NTAccount])

     # Create hashtable for properties
     $properties = @{'Computer'=$pcinfo.Computer;
                     'LastLogon'=$pcinfo.Lastlogon;
                     'ipv4Address'=$pcinfo.ipv4Address;
                    'OperatingSystem'=$pcinfo.OperatingSystem
                     'User'=$username.value
                    } #end $properties
     write-output (New-Object -Typename PSObject -Property $properties) |
     export-csv .\Computers.csv -append -notypeinformation -encoding "unicode"         
            }

Powershell Get-ADComputer Properties Expression

2
  • Please check your code.  Are there supposed to be back-ticks in it?  Hint: use Code Sample formatting rather than Block Quote. Nov 13, 2017 at 13:41
  • Updated to code block
    – Frank
    Nov 13, 2017 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.