在Active Directory PowerShell中获取活动用户

Question

I have created a tool that counts the active users in Active directory for the last 5 minutes for example. However, my script is allways returning around the same amount of active users, even at night.

Here is the part of my script that counts the active users:

$Date=Get-Date #Getting the Date of the mesure
$TpsDerLog= ($Date).AddMinutes(-5) #Creating the time marker for inactive user (mesure time - 5 minutes)
$Liste= Get-ADUser -Server "reseau" -filter {(enabled -eq $True) -and (objectclass -eq "user")} #Getting all the enabled accounts in the Active Directory
$ListeN = Get-ADUser -Server "reseau" -filter { (LastLogonTimeStamp -lt $TpsDerLog) -and (objectclass -eq "user") -and (enabled -eq $True) } -Properties LastLogonTimeStamp #Getting the inactive Enabled users 
$nb=($Liste.count)+(-$ListeN.count) #Substracting The inactive users to the total

Answer 1

Your code is giving you the difference between all active (not disabled users) in your AD (saved in $Liste) and users that have logged in to the domain recently. 5 minutes difference won't help you, since the LastLogonTimeStamp attribute is calculated as 14 days minus random percentage of 5 days.

Useful links:

LastLogonTimeStamp Attribute

Difference between LastLogon and LastLogonTimeStamp

Play around with AddDays() method, and you will get more accurate results about how users log in to your domain on a daily basis.

Answer 2

What your trying to do can't really been done through Active Directory . A user maybe logged into to the domain and leave their session locked or disconnected from the machine/server, then go home.

This information is not passed back to Active directory so the LastLogon variables will remain the same until the user comes back and unlocks the machine (authenticate against a Domain controller). This is why you will see users as active at night even if they have gone home.

The only way that you could tell if a use was currently active on a session would be to interrogate the machine they were on and return the session status. But connected to a lots of domain machines isn't ideal. So the best way to get a figure of logged on users would be to track a domain controllers event log and check for users that have a logon event but don't have a logoff event in a set time period.