Comments on: Find User’s Last Logon Time using 4 Easy Methods

By: Rafael

Rafael

What cmd prompt or powershell script can I user to check when a user last logged into a specific computer?

By: Prajwal Desai

Prajwal Desai

In reply to sv. I think we have to use CMPivot or some other tools to get this done.

By: sv

Hello Prajwal,

How to find 10k machines’ last login time?

By: RickD

RickD

To run a PowerShell script to run Lastlogon and email the results and use the speech synthesizer to read out results try :

Get-ADUser -Filter * -Properties lastLogon | Select samaccountname, @{Name=”lastLogon”;Expression={[datetime]::FromFileTime($_.’lastLogon’)}} > C:\temp\lastlogin.csv
$From = “me@domain.org”
$To = “me@domain.org”
$Attachment = “C:\Temp\lastlogin.csv”
$Subject = “Last Login”
$Body = “Users LastLogin”
$SMTPServer = “192.168.***.**”
$SMTPPort = “587”
$password = ConvertTo-SecureString ‘My AD password’ -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential (‘rderousse’, $password)
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { return $true } # disable certificate
Send-MailMessage -From $From -to $To -Subject $Subject -Body $Body -SmtpServer $SMTPServer -Port $SMTPPort -UseSsl -Credential $credential -Attachments $Attachment

if($smtpport) {
Add-Type -AssemblyName System.speech
$speak = New-Object System.Speech.Synthesis.SpeechSynthesizer
$speak.Rate = 1
$speak.SetOutputToDefaultAudioDevice ;
$speak.Speak(“Your Program has completed and your email will arrive shortly”)
$speak.Dispose() }

By: Jase

Jase

Hi Prajwal, thankyou this was helpful. Can I suggest a small tweak to a screenshot to help people new to powershell.

In method 3 the two screen shots could build on each other.

First screenshot has
Get-ADUser -Identity “username” -Properties LastLogon

Second screen shot could reuse the above like this, repeating/building on the line above
Get-ADUser -Identity “username” -Properties LastLogon | Select-Object Name, @{N=’LastLogon’; E={[DateTime]::FromFileTime($_.LastLogon)}}

Currently the second screen shot does this
Get-ADUser -Filter {Name -eq “username”} -Properties * | Select-Object Name, @{N=’LastLogon’; E={[DateTime]::FromFileTime($_.LastLogon)}}

I just thought it may be easier for a novice to pick up by showing how one thing builds on the next.
Not a big deal… thankful for the article.

By: Mdw

Mdw

Hi, thanks for this great post.
I need to identify last logon by user with computer name and date
Ex:

user john01 last logon computername hpdesk001 06/01/2022 08:00:00

or all users last logon with computers name and date

Can you help me pls?

Happy new year.

Rgds;

Mdw

By: Ali

Ali

If we use “last” instead of “Last”. It shows last password set.

By: MM

What about if there are multiple AD controllers? Not all data is synced between them, like last logontime. With powershell you can ask every single ad about the lastlogon attribute:
$username = Read-Host -Prompt “user login: “-Verbose
$DC_list = ((get-addomaincontroller -filter * | sort name).hostname)
$(foreach
($DC in $DC_list )
{
$user = get-aduser $username -properties LastBadPasswordAttempt,lastlogon -server $DC | select name,LastBadPasswordAttempt,lastlogon
echo “$DC `n $(w32tm /ntte $user.lastlogon)
`n $( $user.LastBadPasswordAttempt)”
})

By: Prajwal Desai

Prajwal Desai

In reply to Alton Brinja. Thanks. Glad to hear that.

By: Erick

Erick

Your code for Method 3 ignores an important condition. What happens when there is a special value to indicate that the user has never logged on?