none
Last Login/Logoff for 5 users in 1 Server RRS feed

  • Question

  • Hi all,

    I need to know when does the user logon/logoff for 5 users in 1 Server (it's web server). Does anyone know a script for this ?

    Tuesday, July 31, 2018 4:06 AM

Answers

  • Hi,

    Code below will check for Logon and Logoff events in the Windows Event viewer for specific users, supplied in the $UserPrincipalNames variable.

    $ComputerName = "example-web01"
    $UserPrincipalNames = "user1@contoso.com", "user2@contoso.com", "user3@contoso.com", "user4@contoso.com", "user5@contoso.com"
    
    foreach ($UserPrincipalName in $UserPrincipalNames) {
        # Get Last Logon Date
        $LastLogon = Get-WinEvent -Computername $ComputerName -FilterHashtable @{Logname='Security'; ID=4672} |
            Where-Object { $_.Properties[1].Value -eq $UserPrincipalName } |
            Select-Object TimeCreated, Properties -First 1
    
        # Get Last Logoff Date
        $LastLogoff = Get-WinEvent -Computername $ComputerName -FilterHashtable @{Logname='Security'; ID=4647} |
            Where-Object { $_.Properties[0].Value -eq $LastLogon.Properties[0].Value } |
            Select-Object $_.TimeCreated -First 1
    
        New-Object -TypeName PSObject -Property @{
            UserPrincipalName = $UserPrincipalName
            LastLogonData = $LastLogon.TimeCreated
            LastLogoffDate = $LastLogoff.TimeCreated
        }
    }

    Please let us know if this is what you are looking for.

    Best regards,

    John

    • Marked as answer by Bremen6 Thursday, September 6, 2018 8:20 AM
    Tuesday, July 31, 2018 6:01 AM

All replies

  • Hi,

    Code below will check for Logon and Logoff events in the Windows Event viewer for specific users, supplied in the $UserPrincipalNames variable.

    $ComputerName = "example-web01"
    $UserPrincipalNames = "user1@contoso.com", "user2@contoso.com", "user3@contoso.com", "user4@contoso.com", "user5@contoso.com"
    
    foreach ($UserPrincipalName in $UserPrincipalNames) {
        # Get Last Logon Date
        $LastLogon = Get-WinEvent -Computername $ComputerName -FilterHashtable @{Logname='Security'; ID=4672} |
            Where-Object { $_.Properties[1].Value -eq $UserPrincipalName } |
            Select-Object TimeCreated, Properties -First 1
    
        # Get Last Logoff Date
        $LastLogoff = Get-WinEvent -Computername $ComputerName -FilterHashtable @{Logname='Security'; ID=4647} |
            Where-Object { $_.Properties[0].Value -eq $LastLogon.Properties[0].Value } |
            Select-Object $_.TimeCreated -First 1
    
        New-Object -TypeName PSObject -Property @{
            UserPrincipalName = $UserPrincipalName
            LastLogonData = $LastLogon.TimeCreated
            LastLogoffDate = $LastLogoff.TimeCreated
        }
    }

    Please let us know if this is what you are looking for.

    Best regards,

    John

    • Marked as answer by Bremen6 Thursday, September 6, 2018 8:20 AM
    Tuesday, July 31, 2018 6:01 AM
  • Web servers do not have logon records that are logged in the event log unless the server is using integrated security. 

    \_(ツ)_/

    Tuesday, July 31, 2018 9:07 AM
  • Hi John,

    I am getting empty value on LastLogoffDate and LAstLogonDate as below:

    LastLogoffDate             LastLogonData              UserPrincipalName        
    --------------             -------------              -----------------        
                                                                   billybob@brolyz.com

    Tuesday, July 31, 2018 11:21 PM
  • i realize it is actually a sharepoint server.
    Tuesday, July 31, 2018 11:21 PM
  • there IS no such thing as LastLogOffate.


    \_(ツ)_/

    Tuesday, July 31, 2018 11:35 PM