Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I've been working on a Powershell script that needs to detect if an interactive logon has happened since the last reboot. I can force the system to restart before I launch the task, but I'd like to add some intelligence to the script.

Caveats:

  • Must use Powershell.
  • Can't require special power packs or addins.
  • Can't use Active directory commands. (No get-qaduser)

I am able to get the last time the system rebooted already:

$date = Get-WmiObject Win32_OperatingSystem | %{$_.LastBootUpTime} 
$RebootTime = [System.DateTime]::ParseExact($date.split(".")[0],'yyyyMMddHHmmss',$null) 

Any ideas? Thanks in advance

share|improve this question
1  
Are we talking a specific user or any user? –  Zypher May 26 '11 at 19:05
    
@Zypher - Any user. We mainly need to know if someone has logged on locally to the machine. I've tried looking in the win32_NetworkLoginProfile WMI object, but the LastLogon property doesn't hold the correct time. –  Doltknuckle May 26 '11 at 19:51
add comment

1 Answer

up vote 4 down vote accepted

If you're set on using WMI, you can get LastBootUpTime a bit cleaner:

PS C:\> $wmi = Get-WmiObject -Class Win32_OperatingSystem
PS C:\> $rebootTime = $wmi.ConvertToDateTime($wmi.LastBootUpTime)
PS C:\> $rebootTime
Tuesday, May 24, 2011 3:18:28 PM

Taking that, we search the Security Event Log, since $rebootTime, for the most recent, successful, eventID 4624 containing Logon Type 2 -- Interactive Logon:

PS C:\> $entry = Get-EventLog -After $rebootTime -LogName Security | Where-Object {($_.EventID -eq '4624') -and ($_.EntryType -eq 'SuccessAudit') -and ($_.Message | Select-String "Logon Type:\t\t\t2")} | Select-Object -First 1
PS C:\> $lastLogon = $entry.TimeGenerated
PS C:\> $lastLogon
Tuesday, May 24, 2011 3:19:34 PM

Then, a quick compare:

PS C:\> $lastLogon -gt $rebootTime
True

The above code can be dumped into a script and/or executed on a remote computer. I only ran the commands interactively to demonstrate the example output.

share|improve this answer
    
Should you maybe add a "| sort-object TimeGenerated " before you do the select -first 1? –  Mike Shepard May 26 '11 at 20:41
    
@Mike: In my testing Get-EventLog Security returned entries in reverse chronological order. But your suggestion wouldn't hurt. –  jscott May 26 '11 at 21:18
    
That is exactly what I needed. Thanks! –  Doltknuckle May 26 '11 at 21:28
    
Sorry...I'm a DBA. I don't trust sorting that isn't explicit. As soon as you trust it, it tricks you. –  Mike Shepard May 27 '11 at 2:03
    
@Mike No worries! If this had been a more specific question I would certainly recommend verifying the ORDER BY. @DolyKnuckle's question asked how to determine if an interactive logon had occurred since the last reboot, not necessarily the most recent since reboot -- so I cut a corner there. –  jscott May 27 '11 at 2:16
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.