Powershell to output Last User Logon to specific XP machines

Need to create a powershell script to output to CSV last logged on user with a timestamp and to supply the machines operating system.

Heres what I have so far:

import-module ActiveDirectory
Get-ADComputer -Filter * -Property * | Select-Object Name,OperatingSystem,OperatingSystemServicePack,OperatingSystemVersion,sAMAccountName,@{N='LastLogon'; E={[DateTime]::FromFileTime($_.LastLogon)}} | Export-CSV c:\temp\AllWindows.csv -NoTypeInformation -Encoding UTF8
adrochoaAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

arnoldCommented:
Why not make a simple bat login for user GPO?


That will report upon login and a logout will record the logout.
0
adrochoaAuthor Commented:
The problem I'm having is that not everyone restarts or log on at start of business. That mentioned process might take a whole year to report on 3000+ users.

The script mentioned above will get me All machines together with their last time logged on, but I still am missing what user logged in to it.
0
cantorisCommented:
The problem is an AD computer account doesn't have an attribute for last logged on username.

You could use a WMI call to the PC to get the current user at the console of the machine.  The extra column would be this:

@{N='Current User';E={(Get-WmiObject -ComputerName ($_.DNSHostName) -Class Win32_ComputerSystem -EA SilentlyContinue) | Select-Object -ExpandProperty UserName}}

It's not ideal as you'll get a delay while each is contacted - esp if you have to wait for a timeout.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
arnoldCommented:
You could query the AD for user account and their last logon date.
You could scour the event log using the tool from aclocal
http://www.microsoft.com/en-us/download/details.aspx?id=18465

If you aggregate/forward logs from systems, you can find the information you want.

you can use tasklist /v or powershell wmi tie in to see what processes are running on each system with which username.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.