locked
Get last logon time,computer and username together with Powershell RRS feed

  • Question

  • I have a script which gets the last logon times of each computer in the domain.

    My script:

    $dcs = Get-ADComputer -Filter { OperatingSystem -NotLike '*Server*' } -Properties OperatingSystem
    
    foreach($dc in $dcs) { 
        Get-ADComputer $dc.Name -Properties lastlogontimestamp | 
        Select-Object @{n="Computer";e={$_.Name}}, @{Name="Lastlogon"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}}
    }
    

    ==================================

    Result:

    Computer Lastlogon -------- --------- DC1 6/06/2013 16:38:24 DC2 6/06/2013 16:30:40

    =============================================

    I also want to get who/which account made this logon. For example:

    Computer Lastlogon User -------- ------------------ ---- DC1 6/06/2013 16:38:24 user2 DC2 6/06/2013 16:30:40 user1



    Wednesday, January 14, 2015 6:53 PM

Answers

  • This gets the last user on a workstation:

    Get-WinEvent  -Computer WS7012 -FilterHashtable @{Logname='Security';ID=4672} -MaxEvents 1|
         select @{N='User';E={$_.Properties[1].Value}}


    ¯\_(ツ)_/¯


    • Edited by jrv Wednesday, January 14, 2015 8:53 PM
    • Marked as answer by Joan Alex Calazans Thursday, January 15, 2015 6:45 PM
    Wednesday, January 14, 2015 8:53 PM

All replies