Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Determining When a User Last Logged On

Posted on 2013-06-05
6
Medium Priority
?
360 Views
Last Modified: 2013-11-14
Is there a way in Server 2008 R2 AD to determing when a user last loged on?  I have probably over a hundred accounts that are from people that are no longer employed and i need to clean up my OU's.
0
Comment
Question by:CADRE308
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 23

Expert Comment

by:tailoreddigital
ID: 39223493
0
 

Author Comment

by:CADRE308
ID: 39223535
I saw that during a Google Search but was hoping for something that would allow me to add it to the account details. I found such .dll that could be added to Server 2003 but no luck for 2008 R2. I was hoping to avoid having to run a script for every suspecious account.
0
 
LVL 23

Expert Comment

by:tailoreddigital
ID: 39223676
0
Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 83

Accepted Solution

by:
David Johnson, CD, MVP earned 2000 total points
ID: 39223683
best practice is when a user is no longer employed to disable their AD account.

Here is a script that you can run periodically.. it will search the entire OU and disable and report accounts that haven't been active for 90 days, mark in the description when the account was disabled, and remove accounts that have been disabled for more than 14 days based upon the date disabled in the description

#import the ActiveDirectory Module
Import-Module ActiveDirectory
#Create a variable for the date stamp in the log file
$LogDate = get-date -f yyyyMMddhhmm
#Sets the OU to do the base search for all user accounts, change for your env.
$SearchBase = "OU=User_Accounts,DC=DEVLAB,DC=LOCAL"
#Create an empty array for the log file
$LogArray = @()
#Sets the number of days to delete user accounts based on value in description field
$Disabledage = (get-date).adddays(-14)
#Sets the number of days to disable user accounts based on lastlogontimestamp and pwdlastset.
$PasswordAge = (Get-Date).adddays(-90)
#RegEx pattern to verify date format in user description field.
$RegEx = '^(0[1-9]|1[012])[- /.](0[1-9]|[12][0-9]|3[01])[- /.](20)\d\d$'
#Use ForEach to loop through all users with description date older than date set. Deletes the accounts and adds to log array.
ForEach ($DeletedUser in (Get-Aduser -searchbase $SearchBase -Filter {enabled -eq $False} -properties description ) ){
  #Verifies description field is in the correct date format by matching the regular expression from above to prevent errors with other disbaled users.
  If ($DeletedUser.Description -match $Regex){
    #Compares date in the description field to the DisabledAge set.
    If((get-date $DeletedUser.Description) -le $Disabledage){
      #Deletes the user object. This will prompt for each user. To suppress the prompt add "-confirm:$False". To log only add "-whatif".
      Remove-ADObject $DeletedUser
        #Create new object for logging
        $obj = New-Object PSObject
        $obj | Add-Member -MemberType NoteProperty -Name "Name" -Value $DeletedUser.name
        $obj | Add-Member -MemberType NoteProperty -Name "samAccountName" -Value $DeletedUser.samaccountname
        $obj | Add-Member -MemberType NoteProperty -Name "DistinguishedName" -Value $DeletedUser.DistinguishedName
        $obj | Add-Member -MemberType NoteProperty -Name "Status" -Value 'Deleted'
        #Adds object to the log array
        $LogArray += $obj
    }
  }
}

#Use ForEach to loop through all users with pwdlastset and lastlogontimestamp greater than date set. Also added users with no lastlogon date set. Disables the accounts and adds to log array.
ForEach ($DisabledUser in (Get-ADUser -searchbase $SearchBase -filter {((lastlogondate -notlike "*") -OR (lastlogondate -le $Passwordage)) -AND (passwordlastset -le $Passwordage) -AND (enabled -eq $True)} )) {
  #Sets the user objects description attribute to a date stamp. Example "11/13/2011"
  set-aduser $DisabledUser -Description ((get-date).toshortdatestring())
  #Disabled user object. To log only add "-whatif"
  Disable-ADAccount $DisabledUser
    #Create new object for logging
    $obj = New-Object PSObject
    $obj | Add-Member -MemberType NoteProperty -Name "Name" -Value $DisabledUser.name
    $obj | Add-Member -MemberType NoteProperty -Name "samAccountName" -Value $DisabledUser.samaccountname
    $obj | Add-Member -MemberType NoteProperty -Name "DistinguishedName" -Value $DisabledUser.DistinguishedName
    $obj | Add-Member -MemberType NoteProperty -Name "Status" -Value 'Disabled'
    #Adds object to the log array
    $LogArray += $obj
}
#Exports log array to CSV file in the temp directory with a date and time stamp in the file name.
$logArray | Export-Csv "C:\Temp\User_Report_$logDate.csv" -NoTypeInformation

Open in new window

http://blogs.technet.com/b/heyscriptingguy/archive/2011/11/30/use-powershell-to-find-and-remove-inactive-active-directory-users.aspx
0
 
LVL 3

Expert Comment

by:violageek
ID: 39227819
I know you asked for something that you can add to the attributes but here is another PS script that exports the login times to a csv file that you can use for clean up if necessary.

http://www.clintmcguire.com/get-alluserlastlogon/

Hope this helps!
0
 
LVL 2

Expert Comment

by:oliverbob
ID: 39237962
I don't know how to tell which user on which computer but I can tell you how to know when the computer last touched your network. In ADUnC, make sure Advanced is selected from under view menu. On the AD computer object you can goto attribute editor tab (in modern versions of AD tools) and look for lastLogonTimeStamp which will tell you when the computer last booted or logged into the network (every computer on the Domain actually logs in with their own secret password). It's accurate to within 5 days.

Also some info that may help for the future Get a list of who logged in to each server

new Server 2008 R2 features for account auditing and logon events http://technet.microsoft.com/en-us/library/dd560628(WS.10).aspx

free MS tracking tool for next time "limitlogin" http://technet.microsoft.com/en-us/magazine/2005.05.utilityspotlight.aspx

Moreover I found some applications also for the same. I hope they can also be useful for you. If you suggest.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A safe way to clean winsxs folder from your windows server 2008 R2 editions
Resolving an irritating Remote Desktop connection that stops your saved credentials from being used.
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…

609 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question