Last user to login to specific computer

[its_sam]

I am hoping to use PowerShell to track down a missing laptop.

 

I have the computer name and have been able to determine the last login date by running get-adcomputer -identity computername -properties * but this does not give the name of the last user to login.

 

Is there such a command?

[halbaradkenafin]

I am hoping to use PowerShell to track down a missing laptop.

 

I have the computer name and have been able to determine the last login date by running get-adcomputer -identity computername -properties * but this does not give the name of the last user to login.

 

Is there such a command?

 

There are two ways to find this out, one is to query the Event Logs of the actual device (not possible in this situation) and the other is to query the event logs of the DC (may not be possible depending on how long ago it was). I've got a script in the "Have you got a script for..." thread that can query DCs and could be modified slightly to let you find a specific device.

 

Edit: something else that occurs to me is that it might be possible to track it down using your web filtering solution, depending on what you have. If your web filter logs username and source ip/computer then you should be able to bring up all the recent logs for the last IP that device had (hopefully still in DHCP or DNS) and find out the user that way.

Edited June 16, 2015 by halbaradkenafin