Exporting LastLogonTimestamp

[penfold]

I'm trying to run some checks that our systems are commubnicating with our AV server properly. As such I want to export the LastLogonTimeStamp from AD so I can run a comparison with our AV server. The problem is that if I get the timestamp when I try and export it to csv it just exports the variable length. I was pretty sure I have done this (or something similar) in the past but I can't find any script I have. I am trying to use Export-csv which gives me the vairable length and also I have tried Out-File also but this exports a single entry on each line. What I need to do is export a number of fields into 1 csv so I can do some reports from it.

 

How can I get the LastLogonTimeStamp value and export to csv the actual date?

 

Thanks

[thimon]

Hi @penfold I modified a script we were already using. Running the below script will export a .csv file with their name (from within a specified OU) and last logged on time.

 

Get-ADUser -searchbase " OU=ou name,DC=name,DC=name" -Filter {Enabled -eq $true} -Properties Name,LastLogon |
Select-Object Name,@{n='LastLogon';e={[DateTime]::FromFileTime($_.LastLogon)}} | Export-CSV c:\ADusers.csv

[themightymrp]

You might be able to convert the below couple of lines into a For / Next loop to do multiple users:

 

$convert_lastlogontimestamp = @{Name="LastLogonTimeStamp";Expression={([datetime]::FromFileTime($_.LastLogonTimeStamp))}}

Get-ADuser username -properties lastlogontimestamp | select samaccountname, $convert_lastlogontimestamp | Export-Csv -path c:\folder\filename.csv

 

 

EDIT - damn beaten to it!

[HPlum78]

LastLogonTimestamp may not be the attribute to use. This is due to the way that this attribute works, to stop a mass of replication traffic each time a user logs in this attribute is only updated (and for that matter synced) based on a calculation on another attribute (ms-DS-Logon-Time-Sync-Interval) the default is 14 days +- some other number from memory. So this means that if the logon happens within this calculation the LastLogonTimestamp attribute will not be updated. This will ultimately skew your results and should not be relied on for determining the last logon for a user account. Edited November 12, 2018 by HPlum78

[HPlum78]

https://gallery.technet.microsoft.com/scriptcenter/Get-Last-Logon-for-Users-c8e3eab2

 

The above is a function that gets the lastlogon attribute from each DC and returns the latest one. You can put this in a for each and iterate through your domain.

 

https://social.technet.microsoft.com/wiki/contents/articles/22461.understanding-the-ad-account-attributes-lastlogon-lastlogontimestamp-and-lastlogondate.aspx

 

I have found the link above that explains the detail around these attributes in more detail.

[penfold]

What I am trying to do is check that systems in our AV console that have an old last communication date are OK by checking the last logon timestamp. I have exported a csv with details from EPO and now I want to add a column which contains the last logon timestamp. If these match then I know the system has not connected to the network. If the Laslogontimestamp is more recent I know there is a problem with communicaiton and so can troublehsoot. I am trying to do a cleanup of old stale entries and want to be sure that that the system is no longer on the network before I delete them from the console.

[penfold]

Thanks, I can get the date properly. Now all I need to do is work out how to import my existing csv data and export it with the additinoal lastlogontimestamp.

[penfold]

I need more help with this. I have 1 csv which contains infomration about systems frmo EPO. What I want to do is add an extra column with the lastlogon date from a DC. What I can currenrtly do is find the lastlogon date and export it to a new csv but not to the end of the line of an existing csv. What I was thinking was that I could import the existing csv file and get the last logon time and export everything to a new csv file which contains all the data. The problem is I don't know how to do it. Would I need to import the csv into an array>get last logon>export array contents to csv? If I export I can either get the date of lastlogon OR if I try and add original content from the imported csv I get the array length.

 

If anyone can help it would be much appreciated.

[fordea]

You've got the right idea. You'll have to import your csv data using the Import-Csv cmdlet, loop through all the rows adding your additional column data and then finally output that to a new/existing csv file using the Export-Csv cmdlet. If you let me know what code you've got so far I can give you a hand with this or you can alter the template below to suit your needs:

 

$inputData = Import-Csv -Path 'C:\input.csv'

foreach ($row in $inputData) {

    $LastLogonTimeStamp = #code here that retrieves the lastlogontimestamp for this particular row

    $row | Add-Member -MemberType NoteProperty -Name 'LastLogonTimeStamp' -Value $LastLogonTimeStamp -Force

}

$inputData | Export-Csv -Path 'C:\output.csv' -NoTypeInformation[/Code]

Edited November 23, 2018 by fordea