Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

OK I have over 500 desktops in my company and can confirm from the lastlogontimestamp which ones are active and which ones are not - so far so good. I now need to know who was the last user to log on to the active ones & ideally get this info from Active Directory.

The desktops are scattered round a campus and might be logged on to only once a month etc. So instead of writing a script that runs at logon to identify the user etc etc, I'd rather get the info from a AD if possible. That way I dont have to wait another month for the unknown pc's to be switched on and then for the user to logon and run my script. If the PC's were left turned on I would be able to interrogate them directly etc etc. But aside from the infrequent use, they are off most of the time. Identifying the user would help me identify where the PC is located etc etc.

I suspect the information is not held within AD simply because I have searched and searched and cant find it but there is no harm in asking. Its a Windows 2008 network with XP & win 7 systems - thanks

share|improve this question
Not versed in PowerShell, but betting that will be your best bet. I have seen some PowerShell scripts querying the AD, and then querying the users of that AD. –  Tim Apr 25 '12 at 19:46
@tim AD does not maintain this bit of info, the security logs on the dc's or workstations do though and yes powershell can help you with that info. –  tony roth Apr 25 '12 at 19:49
You can't get this information from Active Directory per-se, however you can get it from the security logs on your domain controllers. –  Bryan Apr 25 '12 at 19:52

2 Answers 2

You might be able to do this with the “audit account logon events" enabled on your domain controllers. Then, you could look at the "Account Logon" events on your domain controllers and search for specific entries to match the users / computers you are looking for. If you need to pool together entries from various domain controllers, you could subscribe to the events from your admin workstation.

I believe a tool like Splunk could be used for the event monitoring too.

share|improve this answer
I'm pretty sure you also need to either (a) collect all the logs in one place to analyze) or (b) check the logs on each DC in order to make sure you're capturing all the Logon events. It's been a while but if I remember right each DC only logs the events it personally handled. –  voretaq7 Apr 25 '12 at 20:06
that was true with w2k3 dc's but now the info is replicated between dc's –  tony roth Apr 25 '12 at 20:10
@tonyroth Not true for login/logout events in the security log. Those are still per-DC. When I wrote a system to do just this with Server 2008 DCs I had to query every DC in the domain. –  sysadmin1138 Apr 25 '12 at 20:13

I wrote a system to do just this at my old University job. It used the Windows 7/2008 tool wevtutil to extract an XML-formatted dump of the security log of each domain controller after a specific time and then parsed that XML file for the events I'm interested in.

wevtutil qe Security /r:$DC /q:"*[System[((EventID=$LogonID or EventID=$FLogonID or EventID=$LogoffID or EventID=$LockoutID) and TimeCreated[@SystemTime > '$LUFilterString'] and TimeCreated[@SystemTime < '$NowFilterString'] )]] "

It used an XPath formatted query string so I only pulled down the events I was interested in (login, logoff, failed login, lockout).

It then uploaded the processed events to a database I also created. It updated the "last login" information for workstations, as well as a "last logged in to" field for users. This is understandably a batch process, though a realtime method is entirely possible with more .Net skills than I possess.

It was useful. We managed to track the login/out/lockout events for a campus of 22,000 warm bodies (6K of whom were on campus at any given time logging into stuff). During busy times, I was uploading close to 250,000 records per hour.

Yes, that many.

A logged in worksation generates a continual stream of login-events on the domain-controllers, and we tracked them all. It was a rather busy database, and I ended up using bulk-insert to update the tables when it ran every 15 minutes.

Since it dropped the data into a handy MS SQL table, we were able to provide some rather useful data to our helpdesk employees. Such as what station (or IP address) caused a lockout for a user, the last day's worth of workstations a user logged into, and what users logged into a specific workstation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.