We help IT Professionals succeed at work.

I need a quick list of the most recent login time for users starting with Avaya-*

Thor2923
Thor2923 asked
on
I have a windows 2012 AD Domain. The Telecom department came to me with a list of user accounts connected to our phone system They want a list of the last time each account has logged in. In checking ADUC, it appears if I display a user name and go to the OBJECT tab, the MODIFIED tab reveals the last time an account connected. I am trying to do an advance search and search for all accounts starting with AVAYA- and the MODIFIED date of each account. Assuming this does indicate the last time an account connected, which it appears to . I do not care if I use ADUC or a Powershell script. An out put file would be nice too if possible. OR if someone has a better way to get a list of the last time all accounts starting with Avaya- logged in, that would be fine too. ALl ideas welcome
Comment
Watch Question

Probably not helpful to you right now, but I routinely rollout a GPO and logon/logoff scripts that create simple text files on a server share for auditing these events. Bit of effort to set up, but usually turns out to be well worth the effort. Can even create a link on managers desktops, so they can better snoop on staff.

Scripts I have in use at the moment are below:

echo Logon,%DATE%,%TIME%,%COMPUTERNAME% >> \\dc01\onofflogs$\%USERNAME%.txt
echo Logoff,%DATE%,%TIME%,%COMPUTERNAME% >> \\dc01\onofflogs$\%USERNAME%.txt

This creates a new text file for each user, with one line for each logon and logoff event, with the date, time and machine name included. Really useful!
Shaun VermaakSenior Consultant
Awarded 2017
Distinguished Expert 2018

Commented:
Above will work for interactive logons only. I suggest you enable auditing and pull this info from the logs.

If you use the above, only give write access. This information is a goldmine for hackers