1

I am attempting to get a list of "last logon time" of "all users" on Windows Server 2012, but currently only know of how to list a single user login, which is:

net user username | findstr /B /C:"Last logon"

Any ideas?

*P.S. This servers only purpose is to host the RDP connections; not tied to a domain/AD.

  • Unless your rdp users are in a separate silo then it is active directory, please state how users authenticate to sessions – Sum1sAdmin Jul 13 '16 at 20:19
2

For local users, you can use Powershell with ADSI as follows.

$comp=[adsi]"WinNT://$($env:ComputerName)"
$users = $comp.Children | ?{ $_.SchemaClassName -eq 'User' }
$users | select @{L="Name";E={$_.psbase.Properties.Name.Value}},@{L="LastLogin";E={$_.psbase.Properties.LastLogin.Value}}
| improve this answer | |
  • *I forgot to mention: This servers only purpose is to host the RDP connections; not tied to a domain/AD. – 16o1denRatio Jul 13 '16 at 19:13
  • You might want to edit your question to make that more clear. – Ryan Bolger Jul 13 '16 at 19:39
1

If you are in a domain, create a powershell script like that;

Import-Module ActiveDirectory

function Get-ADUsersLastLogon()
{
  $dcs = Get-ADDomainController -Filter {Name -like "*"}
  $users = Get-ADUser -Filter *
  $time = 0
  $exportFilePath = "c:\lastLogon.csv"
  $columns = "name,username,datetime"

  Out-File -filepath $exportFilePath -force -InputObject $columns

  foreach($user in $users)
  {
    foreach($dc in $dcs)
    { 
      $hostname = $dc.HostName
      $currentUser = Get-ADUser $user.SamAccountName | Get-ADObject -Server $hostname -Properties lastLogon

      if($currentUser.LastLogon -gt $time) 
      {
        $time = $currentUser.LastLogon
      }
    }

    $dt = [DateTime]::FromFileTime($time)
    $row = $user.Name+","+$user.SamAccountName+","+$dt

    Out-File -filepath $exportFilePath -append -noclobber -InputObject $row

    $time = 0
  }
}

Get-ADUsersLastLogon

Took from there

| improve this answer | |
  • *I forgot to mention: This servers only purpose is to host the RDP connections; not tied to a domain/AD. – 16o1denRatio Jul 13 '16 at 19:13
1

I've encountered similar problem a while ago. This was the code that produced the results I needed. Works even for local accounts.

$adsi = [ADSI]"WinNT://$env:COMPUTERNAME" $adsi.Children | where {$_.SchemaClassName -eq 'user'} | ft name,lastlogin

Kudos to Anthony Howell in this discussion.

| improve this answer | |
  • The questions appear to be merged into one now. – BorysekOndrej Jul 13 '16 at 20:26
1

Good day. Some years later, I answer this question :)

Maybe someone, like me, find this useful.

Use WMI to query the objet Win32_UserProfile (in each server, no matter if in a domain or not) and obtain the fields 'LocalPath' and 'LastUseTime' (at least). Match the last section of the Path with your AD (If needed) to provide more information.

We needed it some months ago, and it worked like a charm. We remotely pushed it to all the servers through PS-Invoke and export the results to a .csv for batch processing.

https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ee886409(v%3Dvs.85)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.