I am migrating a server and need a list of the last time users logged in, since just getting whos logged in currently won't help as its a remote terminal server and not everyone is logged in at the same time especially with a global company. I understand I can make a script on the login.bat but that will take time to populate over time. Is there any easy way to do this from AD or command line?

Since AD is used for all servers, I am only interested in last logged in for one particular server.

Thank you

  • How are your event logs configured on the terminal server? Have you looked at parsing out the Security log? It should have details about who has authenticated when. – Zoredache Dec 12 '13 at 19:50
  • 1
    The security audit have way too much stuff in it, sorting/parsing everything would take me too long. Is there a way to use query session and get history of say last few weeks? Though I guess I can export it and run it through Excel or something. – Jon Weinraub Dec 12 '13 at 19:56

Why not PowerShell? Something like this should get you started:

Get-EventLog -LogName Security -Newest 1000 | Where-Object {$_.EventID -eq 4624 -or 4634 } | ForEach-Object { $_.Message -split '\n' } | Select-String "Account Name"

You'll need your Audit Policy set appropriately so Windows will log the events in the first place (why this isn't a default setting is beyond me). Additionally you will want to use different EventIDs (528 and 540) for Windows Server 2003.

| improve this answer | |
  • I like the idea of powershell actually, however, i dont know much about it. if i run this as is, it returns no results, but i suppose i will have to trace the code, then, huh? – Jon Weinraub Dec 12 '13 at 21:24
  • @JonWeinraub - See my update. – user62491 Dec 12 '13 at 22:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.