Powershell script for AD Computer Get-ADComputer

Question

Currently I'm using the following script to retrieve the below info from the DC all info is okay but I need to include the user name of the last logged on user name but unfortunately Last logged on user isn't a property that AD computer objects track.so therefore Pls advice.

`$ADComputerProperties = @(``
"Operatingsystem",
"OperatingSystemServicePack",
"SamAccountName",
"LastLogonDate"
)
`$SelectADComputerProperties = @(``
"Name",
"OperatingSystem",
"OperatingSystemServicePack",
"SamAccountName",
"LastLogonDate"
)
`Get-ADComputer -Filter * -Properties $ADComputerProperties | ``
select $SelectADComputerProperties | Out-GridView

Answer 1

Last logged on user isn't a property that AD computer objects track.

It can be, if you make it so.

Here's how it could be done:

1) Set up a scheduled task running as LOCAL SYSTEM on the computer(s) that you need to report last logged on user. The task will be configured to run on a schedule of your choosing and will execute a script you write to collect the last logged on username and write the result to an un-used attribute on the AD computer object. There are several ways to query this information. Suggest researching and picking your favorite method.

2) Grant the "SELF" well-known security principal write access to an un-used AD attribute on the computer object(s). This is how the SYSTEM task will have permission to write to it's own AD computer object.

When the task runs, it will execute your script and write the username to the AD computer object attribute you identified. You can then update your data collection PowerShell script to include that attribute in the results.

Once you get it tested and working on one computer, you can set up the task to run on all of your computers with domain Group Policy. The SELF write permission to the chosen attribute can be set at a top level OU containing all of your target computers and applied to all descendant computer objects.