0

I have a Windows server 2008 R2 vm that has roughly 4800 domain users that have logged in over the last 3 years. Id like to generate a report that list the users names along with the last time they logged in to this particular vm.

Everything I come across through searching is either the last user to log in to a vm or the last log in time of users across a domain. I can't find a way to generate a list of the usernames and the last time they logged in to the specific vm.

Any help?

Improve this question
0
0

If the logs do not go back far enough, you can also find this in the Win32_UserProfile class in WMI.

This PowerShell should get you started:

Get-WmiObject Win32_UserProfile | Select-Object LocalPath,LastUseTime | Sort-Object LastUseTime
Improve this answer
1

Check the Script bellow I have used in the past and works fine (I am not sure If it will fit for you). I think that the server though will not have three years data to show as in such long period will have overwrite those records from its logs. If this is a terminal server you can also check the folder users. All these in theory as of course as many of these depend on Group Policies.

https://gallery.technet.microsoft.com/scriptcenter/Remote-Desktop-Connection-3fe225cd

Improve this answer
2
  • Looks like you were correct.. The script does capture the logoff for each user but my event logs do not go back anywhere close to the time I was hoping to capture largely due to how many people access the vm. One thought, if I look at the C:\Users directory and sort by the Date modified column; how accurate might that be at detailing the users last login? I'm assuming that directory would get modified every time the user logs in since NTUser.dat resides there and is updated by policy at each log in? – mrbarker Jun 7 '17 at 16:27
  • 1
    For the Windows 2012 and 2012R2 this works. For the Windows 2008 R2 (I just tested it) you should test a login of the user and see if it modifies any file in your environment. For mine for example it modifies "C:\Users\Administrator\AppData\Roaming\Microsoft\MMC" because it opens the server manager windows on each login. As it is terminal server I assume some application will open and modify something then you can search a script based on that. Thanks – Alexios Pappas Jun 7 '17 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.