Get last user Powershell script

[jmak]

Hi

 

I have an idea that this isn't possible without auditing turned on, but just in case...

 

I'm running this script:

 

PS C:\Users\Administrator> Import-Module ActiveDirectory 

Get-ADComputer -Filter * -Property * | 

Select-Object Name,OperatingSystem,OperatingSystemVersion,ipv4Address,DistinguishedName,LastLogonDate, | 

Export-CSV "E:\Staff\Myusername\Documents\ADcomputerslist7.csv" -NoTypeInformation -Encoding UTF8

[/Code]
 

I'd like to add a variable to check who last logged on to each machine. I don't need a history - just want to chase down who last touched the machine! Any suggestions?
 

Thanks

Edited July 19, 2019 by jmak

[djm968]

This will do the job.

 

$com=hostname
Get-WmiObject -Class Win32_NetworkLoginProfile -ComputerName $com | 
Sort-Object -Property LastLogon -Descending | 
Select-Object -Property * -First 1 | 
Where-Object {$_.LastLogon -match "(\d{14})"} | 
Foreach-Object { New-Object PSObject -Property @{ Name=$_.Name;LastLogon=[datetime]::ParseExact($matches[0], "yyyyMMddHHmmss", $null)}}

Edited July 19, 2019 by djm968

[jmak]

Thanks. That gets me the last user for the local machine. The script I'm using outputs to a file and gives me a list of properties that the Domain Controller holds. Is there a way to generalise your script so that I get a list for each machine in AD and output the results to a file? IIRC it's not held on the server, but I'd love to be proved wrong. Part of the reason is to track down machines I haven't easily been able to find - also if the machine is off and I log on, the last user is always going to be me....

[djm968]

Thanks. That gets me the last user for the local machine. The script I'm using outputs to a file and gives me a list of properties that the Domain Controller holds. Is there a way to generalise your script so that I get a list for each machine in AD and output the results to a file? IIRC it's not held on the server, but I'd love to be proved wrong. Part of the reason is to track down machines I haven't easily been able to find - also if the machine is off and I log on, the last user is always going to be me....

 

Oh I see, not sure, but I will hunt through the scripts I have to see if I can find something that can be modified.

[HPlum78]

To start with @jmak any command with a -Filter * -properties * is a really bad idea, so much so I will let you look through my previous posts on running commands like that... The best of it is you are doing a select to return the properties you want so put that after the -Properties part of the statement.

 

The next thing to note is that LastLogon is not a replicated attribute (or better said, not to do what you are looking for), so you would need to return this from all the DC's in your domain potentially (could be site but I don't know your setup..)

 

https://blogs.technet.microsoft.com/askds/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works/

 

Added the above for some additional info, i will fish out some more on this when I have more time.

Edited July 20, 2019 by HPlum78