• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 309
  • Last Modified:

NT 4.0 Domain User Audit

I am being asked to do a user audit for our NT 4.0 domain. I need all the usenames and the last logon time and date for all the accounts.
1 Solution
This might do the trick; run it on any domain member.
If it doesn't, please post a sample output of the command
net user SomeUser /domain
(replace "SomeUser" with any valid user account, leave the "/domain" as is).

@echo off
set LogFile=D:\Temp\test.csv
if exist "%LogFile%" del "%LogFile%"
for /f "skip=4 tokens=1-3" %%a in ('net user /domain') do (
  if not "%%a"=="" call :process %%a
  if not "%%b"=="" call :process %%b
  if not "%%c"=="" call :process %%c
goto :eof

set User=%1
:: *** Drop the last line of the "net user" command
if /i "%User%"=="The" goto :eof
if /i "%User%"=="command" goto :eof
if /i "%User%"=="completed" goto :eof

echo Processing %User% ...
for /f "tokens=2*" %%a in ('net user %User% /domain ^| find /i "Last logon"') do set LastLogon=%%b
echo ... %LastLogon%
>>"%LogFile%" echo %User%,%LastLogon%
goto :eof

Featured Post

Upgrade your Question Security!

Add Premium security features to your question to ensure its privacy or anonymity. Learn more about your ability to control Question Security today.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now