powershellactive-directory

Query list of computers - output last logged on user and last logon date


I am creating a script to retrieve all the machine names from a .txt file then Query against them;

ComputerName UserName (Of the last person to logon to the machine) Date it was last Logged on to/Used

This is what i have

Clear-Host
$machines = Get-Content -Path C:\Users\khalifam\Desktop\Winver\MachineNames.txt
ForEach ($Compu in $machines) {
    Get-WmiObject –ComputerName $machines –Class Win32_ComputerSystem | Select 
    Username, PSComputerName | FT
}

Solution

  • As sidenotes:

    Having said that, I don't think you can get the info you need from the WMI Win32_ComputerSystem class..
    What you will need to do is to parse the info from the computers eventlog:

    # get an array of computernames loaded from the text file
    $machines = Get-Content -Path C:\Users\khalifam\Desktop\Winver\MachineNames.txt
    
    $result = foreach ($computer in $machines) {
        # test if the compurer is on-line
        if (!(Test-Connection -ComputerName $computer -Count 1 -Quiet)) {
            Write-Warning "Computer '$computer' is off-line."
            # skip this computer and carry on with the next iteration
            continue
        }
    
        # search the computers eventlog and parse the username and last logon time from that
        # you can play around with other values for -MaxEvents if you feel you're missing information.
        Get-WinEvent -ComputerName $computer -FilterHashtable @{Logname='Security';ID=4672} -MaxEvents 20 | 
            Where-Object { $_.Properties[1].Value -notmatch 'SYSTEM|NETWORK SERVICE|LOCAL SERVICE' } | 
            Select-Object @{Name ='ComputerName'; Expression = {$_.MachineName}},
                          @{Name ='UserName';     Expression = {$_.Properties[1].Value}},
                          @{Name ='LastLogon';    Expression = {$_.TimeCreated}} -First 1
    
    }
    
    # show on screen:
    $result | Format-Table -AutoSize
    
    # save as CSV file
    $result | Export-Csv -Path 'D:\LastLogonInfo.csv' -NoTypeInformation
    


    Update

    If I understand your comment correctly, you would like a list of all users (except for a few) and retrieve their latest login on a computer from the list.

    In that case you can do the following:

    # get an array of computernames loaded from the text file
    $machines = Get-Content -Path C:\Users\khalifam\Desktop\Winver\MachineNames.txt
    $result = foreach ($computer in $machines) {
        # test if the compurer is on-line
        if (!(Test-Connection -ComputerName $computer -Count 1 -Quiet)) {
            Write-Warning "Computer '$computer' is off-line."
            # skip this computer and carry on with the next iteration
            continue
        }
    
        # you do not want to include these account logins
        $exclude = '\$|SYSTEM|NETWORK SERVICE|LOCAL SERVICE|KHALIFAM'
        # search the computers eventlog and parse the username and last logon time from that
        # you can play around with other values for -MaxEvents if you feel you're missing information.
        Get-WinEvent -ComputerName $computer -FilterHashtable @{Logname='Security';ID=4672} -MaxEvents 100 | 
            Where-Object { $_.Properties[1].Value -notmatch $exclude } | 
            Select-Object @{Name ='ComputerName'; Expression = {$_.MachineName}},
                          @{Name ='UserName';     Expression = {$_.Properties[1].Value}},
                          @{Name ='LastLogon';    Expression = {$_.TimeCreated}} |
            Group-Object -Property UserName | ForEach-Object {
                $_.Group | Sort-Object LastLogon -Descending | Select-Object -First 1
            }
    }
    
    # show on screen:
    $result | Format-Table -AutoSize
    
    # save as CSV file
    $result | Export-Csv -Path 'D:\LastLogonInfo.csv' -NoTypeInformation