如何以编程方式获取Active Directory中的计算机列表以及每个计算机的最后登录用户？

Question

I've done a fair amount of research and have learned how to obtain the last logged-in timestamp for users in Active Directory, as well as how to obtain a list of computers from Active Directory. What I can't seem to figure out is how to put the two together, so that I have a list of all computers (or at least the ones from the organizational unit I provide) as well as the last user who logged-into each and the time it occurred. I don't need current logins, just the last login. How can this be done?

I'd prefer C#.

Answer 1

A neat trick is to just look at the last modified timestamp of the folders in C:\\Users. The last modified one is the last person to login. But keep in mind that if an admin person logs in (even remotely), they'll show up on top so you can't just check once and assume it's that person's computer. But if you check 10 times and 9/10 times it's one person, then you can conclude it's that person's computer.

Then you can match up the profile folder to the SID of the account from the registry on that machine: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList

Yes, you can also look at the logs on the domain controllers to see where people are logging in from, but keep in mind that every time someone authenticates to anywhere, that counts as a log in: if someone authenticates an intranet site, I'm pretty sure that'll show up as a login coming from the web server. Same with accessing a file share.