如何扫描计算机列表并查找上次登录的用户以及该用户登录的日期

Question

I have the following script from a previous stackoverflow question.It works in that the script successfully scans my list of computers to report back my userid logged in for each computer.

But what I'm looking for is the last logged in user for each computer in my list. I don't want to scan Active Directory as I don't have access to do that. Here is the code I found that is getting me partway there:

    Get-Content -Path c:\ListOfMachines.txt | % {
  Get-WmiObject -ComputerName $_ -Namespace root\cimv2 -Class Win32_ComputerSystem -erroraction silentlycontinue | % {
    "$($_.Name): $($_.username)"
  }
}

Like I said it works in that it scans each computer in my list but I want it to report back the last logged in user and the date they logged in. Is this something someone has seen before?

Thank you.

Answer 1

You can grab the user SID with the most recent LastUseTime in the Win32_UserProfile class and assign it to a $User variable:

$last_user= Get-WmiObject -ComputerName $_ -Namespace root\cimv2 -Class Win32_UserProfile | Sort-Object -Property LastUseTime -Descending | Select-Object -First 1 
$UserSID = New-Object System.Security.Principal.SecurityIdentifier($last_user.sid) 
$User = $UserSID.Translate([System.Security.Principal.NTAccount])

To format the date from the $last_user:

[Management.ManagementDateTimeConverter]::ToDateTime($last_user.LastUseTime)