1

I would like to audit a user's last logons - unfortunately we have 10 domain controllers and no centralized logging software.

My question is what is the best way to request the last 'n' logon events from user 'x'. I then plan to do a $PS-Session to each domain controller and aggregate all of the results.

My goal is to determine whether or not their account has connected from unknown devices/locations.

Any help would be greatly appreciated. I suspect I'll have to do something with Get-Eventlog and then a filter?

Improve this question
3
  • 1
    Seriously consider centralized logging software. It sounds like your environment is way past the point of needing it.
    – Tim Brigham
    Sep 23, 2015 at 21:50
  • Don't worry, I've been pushing for it for awhile. Have pending quotes for an Arcsight and also dabbling with setting up ElasticSearch/LogStash/Kibana Just a matter of getting the time to do it. Recently moved in to the position of sysadmin when the previous one left.
    – Abraxas
    Sep 23, 2015 at 21:53
  • 1
    I'm a huge spkunk fan, even with the price tag. I set up several of my clients with a one of instance and forwarded the specific logs I needed for analysis. It's a great way to get a foot in the door for the idea.
    – Tim Brigham
    Sep 23, 2015 at 21:57

1 Answer 1

Reset to default
1

ADInfo Free Edition from cjwdev will get you last logon and some info, but won't get you last "n" logon events. You'd need to collect the security logs from the DCs centrally and then parse them (typically with 3rd party software, or SCOM, etc.) to report on this.

You could also use a GPO logon script to have it write details about the logon to a hidden share somewhere that you then go and collect the data about the user, what computer they logged onto, when, etc. You could have it create separate files for each user and just append to that specific file each time (maybe name it their login name.txt)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .