2

I have been using the following command to output the last known login of a list of computers set for decommissioning. The script works but only on the currently logged on DC. How can I get it to cycle through all DCs in the network.

Get-Content C:\noresponse.csv | Foreach-Object {Get-ADComputer $_ -Properties LastLogonDate} | SortLastLogonDate | FT Name, LastLogonDate -Autosize |Out-File C:\TempComputerLastLogonDa

2

Based on your existing PS you want something to help determine old computers in AD.

You can run the PS here:

# Gets time stamps for all computers in the domain that have NOT logged in since after specified date 
# Mod by Tilo 2013-08-27 
import-module activedirectory  
$domain = "domain.mydom.com"  
$DaysInactive = 90  
$time = (Get-Date).Adddays(-($DaysInactive)) 

# Get all AD computers with lastLogonTimestamp less than our time 
Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -Properties LastLogonTimeStamp | 

# Output hostname and lastLogonTimestamp into CSV 
select-object Name,@{Name="Stamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}} | export-csv OLD_Computer.csv -notypeinformation

Or my personal long time favorite from JoeWare:

http://www.joeware.net/freetools/tools/oldcmp/

6
  • I've seen this script but as before it only works on the current DC. I want to cycle through the DC on the entire network. As the server could have logged on more recently on a different DC. – JJJJNR Jun 1 '17 at 12:32
  • The LastLogonTimeStamp attribute on the computer object is queried on the object itself in AD, not on a particular DC per say. If replication is occurring OK then the value returned should be accurate. However, I noticed that even in the Q&A of that page there was a guy that recommended the same oldcmp tool I did in my answer above. Unless you are dead set on using Powershell, I'd use that tool. – TheCleaner Jun 1 '17 at 12:36
  • LastLogonTimeStamp could be up to 14 days old. That is why they are asking about querying each DC for the lastLogon attribute. – Greg Askew Jun 1 '17 at 12:45
  • @GregAskew - correct, which is why I started with my first statement. The purpose of the attribute was to identify old computers. Old as in 60 -90-120 days + typically...or if you don't have a large shop or roaming users I supposed 30 + days, which is what the PS script or oldcmp is designed for. But if the OP is wanting to find computers that haven't logged on in 7 days or more, than that's not really "old/stale" computers IMO. – TheCleaner Jun 1 '17 at 12:56
  • 1
    The script does that already...getting all computer objects with $daysinactive = 90. So not sure what you mean. – TheCleaner Jun 2 '17 at 14:42
3

You're going to want to use the property 'lastlogontimestamp' rather than 'lastlogon'.

LastLogonTimeStamp is a value that is replicated amongst all DCs, but it's not an exact value. It's configurable, but (last I knew) the default was to replicate if the replicated date was more than 14 days.

If you're looking for stale machine accounts (say over 60 days old), you'll pad 14 days onto that.

7
  • Thanks, it outputs lots of random numbers. Do you know how I can inject {[DateTime]::FromFileTime($_.LastLogon)}} into the command line. – JJJJNR Jun 7 '17 at 8:36
  • It's not a random number. That's the Windows Epoch Time. Similar to how Unix calculates time (number of seconds since Jan1, 1970), IIRC Windows is the number of nanoseconds since Jan1, 1601. You need to convert that to a format that's more useful to you. FYI, that's a 64-bit integer, so if you need to do it in a 32-bit language (vbscript is where I had to do this back-in-the-day), it's ugly but do-able. – gWaldo Jun 7 '17 at 12:53
  • technet.microsoft.com/en-us/library/… covers this problem. I also found this web app: epochconverter.com/ldap – gWaldo Jun 7 '17 at 12:56
  • 1
    Excel will convert it, details here. myserverstuff.blogspot.ie/2009/03/… – JJJJNR Jun 8 '17 at 10:18
  • 1
    The formula to convert from ad lastlogon in case the blog goes offline is : =IF(C2>0,C2/(8.64*10^11) - 109205,"") – JJJJNR Jun 9 '17 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.