如何让 psloggedon 从 Active Directory 中提取？

Question

    get-content 'C:\assets.txt' | % {
    $computer = $_
    . 'c:\PSTools\PsLoggedon.exe' -accepteula -l -x \\$Computer 3>$null |
        ? {$_ -match '^\s{2,}((?<domain>\w+)\\(?<user>\S+))'} |
        Select-Object `
            @{n='Computer';e={$Computer}},
            @{n='Domain';e={$matches.Domain}},
            @{n='User';e={$Matches.User}} |
        ? user -notmatch '^Connecting$|^Users$|^NT$'
}

This is what I am using to get all of the currently logged on computers. Is there a way I can combine this with Get-ADUser so I ca pull straight from AD rather than from a txt document?

Answer 1

• Sorry, but currently there is no way through which you can integrate this 'Psloggedon.exe' utility with Active directory commands, ie, 'Get-AdUser'. But you can retrieve the details of currently logged on users on different computers in the network remotely by executing the below powershell function: -

   ‘ function Get-LoggedOnUser
      {
         [CmdletBinding()]
            param
 (
     [Parameter()]
     [ValidateScript({ Test-Connection -ComputerName $_ -Quiet -Count 1 })]
     [ValidateNotNullOrEmpty()]
     [string[]]$ComputerName = $env:COMPUTERNAME
 )
 foreach ($comp in $ComputerName)
 {
     $output = @{ 'ComputerName' = $comp }
     $output.UserName = (Get-WmiObject -Class win32_computersystem -ComputerName $comp).UserName
     [PSCustomObject]$output
         }
           } ‘

The above script will give you currently logged on users on several computer systems in the network that you pass on in place of 'COMPUTERNAME' as below. Please note that you must give a list of computers separated by commas when using the above script for multiple computer systems.

If you have AD in your environment, then you can check the Domain Controller logs to see when an Active Directory user account logs on and it will also tell the machine that the user is logged onto. Refer the below links for more on this: -

http://technet.microsoft.com/en-us/library/cc787176(v=ws.10).aspx

http://technet.microsoft.com/en-us/library/bb742435.aspx

http://www.windowsecurity.com/articles/deciphering-authentication-events-domain-controllers.html

Also, find the below link for more information and reference on the above: -

https://4sysops.com/archives/how-to-find-a-logged-in-user-remotely-using-powershell/

Powershell script to see currently logged in users (domain and machine) + status (active, idle, away)

Answer 2

You would use PowerShell's Get-ADComputer to do this job, not Get-ADUser . Here's a script which does all this work for you. The below mainly lifted from the public domain here and only slightly modified. It pulls and pipes all AD domain computers into C:\Computers.txt, then PS-remotes into each computer in that list to find the logged in, interactive user, and their last login date. Gives you a report file named C:\LoggedOnResults.txt in a nice tabled format.

# Finds and pipes all AD domain computers into Computers.txt, then PS-remotes into each computer in the list to find the logged in, interactive user, and their last login date.  Generates a report file named C:\LoggedOnResults.txt, in a nice tabled format.
    # Deletes the current file C:\Computers.txt (if it exists)
     $FileName = "C:\Computers.txt"
        if (Test-Path $FileName) {
          Remove-Item $FileName
          write-host "$FileName has been deleted"
        }
        
        else {
          Write-host "$FileName doesn't exist"
        }
        
        
        # 0. Capture all AD computers into a text file named Computers.txt
        # importing dependancy, assuming it's already installed.
        # Install RSAT for Windows workstation, AD DS role for Windows Server if missing
        Import-Module "ActiveDirectory"
        
        Get-ADComputer -Filter {(OperatingSystem -like "*windows*") -and (Enabled -eq "True")} | Select -Expand Name | Out-File "C:\Computers.txt"
        
        # 1. Create scriptblock to target computer will execute
        $SB = {
         
            $explorerprocesses = @(Get-WmiObject -Query "Select * FROM Win32_Process WHERE Name='explorer.exe'" -ErrorAction SilentlyContinue)
            if ($explorerprocesses.Count -eq 0)    {
                    New-Object -TypeName PSObject -Property @{
                        ComputerName = $env:COMPUTERNAME;
                        Username = [string]::Empty
                        LoggedOnSince = [string]::Empty
                    }
            } else {
                foreach ($i in $explorerprocesses)    {
                    $Username = $i.GetOwner().User
                    $Domain = $i.GetOwner().Domain
                    New-Object -TypeName PSObject -Property @{
                        ComputerName = $env:COMPUTERNAME ;
                        Username = '{0}\{1}' -f $Domain,$Username ;
                        LoggedOnSince  = ($i.ConvertToDateTime($i.CreationDate)) ;
                    }
                }
            }
        } # endof scriptblock
         
        # 2. Create an empty array to store results
        $results = @()
         
        # 3. Query target computers using PSRemoting
        Get-content "C:\Computers.txt" | ForEach-Object -Process {
            $computer = $_
            try {
                $results += Invoke-Command -ComputerName $Computer -ScriptBlock $SB -ErrorAction Stop
            } catch {
                Write-Warning -Message "Faild to use PSremoting on $Computer because $($_.Exception.Message)"
            }
        }
         
        # 4. Display the results
        $results | Select ComputerName,Username,LoggedOnSince | ft -AutoSize
        
        # 5. Send results to a text file
        
        $results | Select ComputerName,Username,LoggedOnSince | ft -AutoSize | Out-File -FilePath "C:\LoggedOnResults.txt"