I have a script which gets the last logon times of each computer in the domain.
My script:
$dcs = Get-ADComputer -Filter { OperatingSystem -NotLike '*Server*' } -Properties OperatingSystem
foreach($dc in $dcs) {
Get-ADComputer $dc.Name -Properties lastlogontimestamp |
Select-Object @{n="Computer";e={$_.Name}}, @{Name="Lastlogon"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}}
}
==================================
Result:
Computer Lastlogon
——– ———
DC1 6/06/2013 16:38:24
DC2 6/06/2013 16:30:40
=============================================
I also want to get who/which account made this logon. For example:
Computer Lastlogon User
——– —————— —-
DC1 6/06/2013 16:38:24 user2
DC2 6/06/2013 16:30:40 user1
Best Answer
This one might not be perfect but it will get you on the right track. To get the exact last user, please see this script. It will give you further information on how to filter the exact last user. In the below example, I have used, select-object -First 1 which should be a pretty good indicator of the last logged on user. To get the last logged on user, you need to use
To 'join' the Get-ADComputer and Get-WMIObject information, I have used a Hash Table.
If you are running this from a Domain Administrator account, you can take the -credential $credential part out. Otherwise, leave it in and you can run it from a normal workstation with the RSAT tools installed so Get-ADComputer is available.
Code below:
Check the formatting when you use it. Some of it I had to add in an escape (`) character to fit it into the script window.
Thanks, Tim.