Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 366
  • Last Modified:

Determining When a User Last Logged On

Is there a way in Server 2008 R2 AD to determing when a user last loged on?  I have probably over a hundred accounts that are from people that are no longer employed and i need to clean up my OU's.
0
CADRE308
Asked:
CADRE308
1 Solution
 
CADRE308Author Commented:
I saw that during a Google Search but was hoping for something that would allow me to add it to the account details. I found such .dll that could be added to Server 2003 but no luck for 2008 R2. I was hoping to avoid having to run a script for every suspecious account.
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
David Johnson, CD, MVPOwnerCommented:
best practice is when a user is no longer employed to disable their AD account.

Here is a script that you can run periodically.. it will search the entire OU and disable and report accounts that haven't been active for 90 days, mark in the description when the account was disabled, and remove accounts that have been disabled for more than 14 days based upon the date disabled in the description

#import the ActiveDirectory Module
Import-Module ActiveDirectory
#Create a variable for the date stamp in the log file
$LogDate = get-date -f yyyyMMddhhmm
#Sets the OU to do the base search for all user accounts, change for your env.
$SearchBase = "OU=User_Accounts,DC=DEVLAB,DC=LOCAL"
#Create an empty array for the log file
$LogArray = @()
#Sets the number of days to delete user accounts based on value in description field
$Disabledage = (get-date).adddays(-14)
#Sets the number of days to disable user accounts based on lastlogontimestamp and pwdlastset.
$PasswordAge = (Get-Date).adddays(-90)
#RegEx pattern to verify date format in user description field.
$RegEx = '^(0[1-9]|1[012])[- /.](0[1-9]|[12][0-9]|3[01])[- /.](20)\d\d$'
#Use ForEach to loop through all users with description date older than date set. Deletes the accounts and adds to log array.
ForEach ($DeletedUser in (Get-Aduser -searchbase $SearchBase -Filter {enabled -eq $False} -properties description ) ){
  #Verifies description field is in the correct date format by matching the regular expression from above to prevent errors with other disbaled users.
  If ($DeletedUser.Description -match $Regex){
    #Compares date in the description field to the DisabledAge set.
    If((get-date $DeletedUser.Description) -le $Disabledage){
      #Deletes the user object. This will prompt for each user. To suppress the prompt add "-confirm:$False". To log only add "-whatif".
      Remove-ADObject $DeletedUser
        #Create new object for logging
        $obj = New-Object PSObject
        $obj | Add-Member -MemberType NoteProperty -Name "Name" -Value $DeletedUser.name
        $obj | Add-Member -MemberType NoteProperty -Name "samAccountName" -Value $DeletedUser.samaccountname
        $obj | Add-Member -MemberType NoteProperty -Name "DistinguishedName" -Value $DeletedUser.DistinguishedName
        $obj | Add-Member -MemberType NoteProperty -Name "Status" -Value 'Deleted'
        #Adds object to the log array
        $LogArray += $obj
    }
  }
}

#Use ForEach to loop through all users with pwdlastset and lastlogontimestamp greater than date set. Also added users with no lastlogon date set. Disables the accounts and adds to log array.
ForEach ($DisabledUser in (Get-ADUser -searchbase $SearchBase -filter {((lastlogondate -notlike "*") -OR (lastlogondate -le $Passwordage)) -AND (passwordlastset -le $Passwordage) -AND (enabled -eq $True)} )) {
  #Sets the user objects description attribute to a date stamp. Example "11/13/2011"
  set-aduser $DisabledUser -Description ((get-date).toshortdatestring())
  #Disabled user object. To log only add "-whatif"
  Disable-ADAccount $DisabledUser
    #Create new object for logging
    $obj = New-Object PSObject
    $obj | Add-Member -MemberType NoteProperty -Name "Name" -Value $DisabledUser.name
    $obj | Add-Member -MemberType NoteProperty -Name "samAccountName" -Value $DisabledUser.samaccountname
    $obj | Add-Member -MemberType NoteProperty -Name "DistinguishedName" -Value $DisabledUser.DistinguishedName
    $obj | Add-Member -MemberType NoteProperty -Name "Status" -Value 'Disabled'
    #Adds object to the log array
    $LogArray += $obj
}
#Exports log array to CSV file in the temp directory with a date and time stamp in the file name.
$logArray | Export-Csv "C:\Temp\User_Report_$logDate.csv" -NoTypeInformation

Open in new window

http://blogs.technet.com/b/heyscriptingguy/archive/2011/11/30/use-powershell-to-find-and-remove-inactive-active-directory-users.aspx
0
 
violageekCommented:
I know you asked for something that you can add to the attributes but here is another PS script that exports the login times to a csv file that you can use for clean up if necessary.

http://www.clintmcguire.com/get-alluserlastlogon/

Hope this helps!
0
 
oliverbobCommented:
I don't know how to tell which user on which computer but I can tell you how to know when the computer last touched your network. In ADUnC, make sure Advanced is selected from under view menu. On the AD computer object you can goto attribute editor tab (in modern versions of AD tools) and look for lastLogonTimeStamp which will tell you when the computer last booted or logged into the network (every computer on the Domain actually logs in with their own secret password). It's accurate to within 5 days.

Also some info that may help for the future Get a list of who logged in to each server

new Server 2008 R2 features for account auditing and logon events http://technet.microsoft.com/en-us/library/dd560628(WS.10).aspx

free MS tracking tool for next time "limitlogin" http://technet.microsoft.com/en-us/magazine/2005.05.utilityspotlight.aspx

Moreover I found some applications also for the same. I hope they can also be useful for you. If you suggest.
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now