I would like to audit a user's last logons - unfortunately we have 10 domain controllers and no centralized logging software.
My question is what is the best way to request the last 'n' logon events from user 'x'. I then plan to do a $PS-Session to each domain controller and aggregate all of the results.
My goal is to determine whether or not their account has connected from unknown devices/locations.
Any help would be greatly appreciated. I suspect I'll have to do something with Get-Eventlog and then a filter?