NT 4.0 Domain User Audit

Posted on 2007-10-15
Last Modified: 2013-12-28
I am being asked to do a user audit for our NT 4.0 domain. I need all the usenames and the last logon time and date for all the accounts.
Question by:knightrg
    1 Comment
    LVL 82

    Accepted Solution

    This might do the trick; run it on any domain member.
    If it doesn't, please post a sample output of the command
    net user SomeUser /domain
    (replace "SomeUser" with any valid user account, leave the "/domain" as is).

    @echo off
    set LogFile=D:\Temp\test.csv
    if exist "%LogFile%" del "%LogFile%"
    for /f "skip=4 tokens=1-3" %%a in ('net user /domain') do (
      if not "%%a"=="" call :process %%a
      if not "%%b"=="" call :process %%b
      if not "%%c"=="" call :process %%c
    goto :eof

    set User=%1
    :: *** Drop the last line of the "net user" command
    if /i "%User%"=="The" goto :eof
    if /i "%User%"=="command" goto :eof
    if /i "%User%"=="completed" goto :eof

    echo Processing %User% ...
    for /f "tokens=2*" %%a in ('net user %User% /domain ^| find /i "Last logon"') do set LastLogon=%%b
    echo ... %LastLogon%
    >>"%LogFile%" echo %User%,%LastLogon%
    goto :eof

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Don't lose your head updating email signatures!

    Do your end users still have the wrong email signature? Do email signature updates bore you or fill you with a sense of dread? You can make this a whole lot easier on yourself by trusting an Exclaimer email signature management solution. Over 50 million users should you!

    To find the source of an account lockout, look in the local Event Viewer>Security, and look at the Failure Audits, for any that match either SYSTEM, or the UserID in question. If you find any, open the log entry, and you will see a Logon Type entr…
    Several part series to implement Internet Explorer 11 Enterprise Mode
    As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
    Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    10 Experts available now in Live!

    Get 1:1 Help Now