realtimer
asked on
How do I find a list of all domain users logged into a workstation + timestamp?
We have a client that is needing to replace several PCs. We would like to run a registry query or CMD/Powershell script that will show you a list of all domain users last logged into a specific domain workstation. From my research, all the commands show you a single last user logged on, but, I need the entire list + timestamp as we have multiple domain profiles logged into a PC.
For example, a domain PC will have about 6-8 profiles typically, if a easy view showed us that 3 out of 8 have signed in the PC within the past few months, we'll proceed backing up settings/data. If they're not logged in for a high amount of time, our plan was going to be to skip passed that profile.
For example, a domain PC will have about 6-8 profiles typically, if a easy view showed us that 3 out of 8 have signed in the PC within the past few months, we'll proceed backing up settings/data. If they're not logged in for a high amount of time, our plan was going to be to skip passed that profile.
ste5an
You can query the event log of that machine or you can just sort the local users directory by date.
Just open C:\Users and see what profiles are used (sort it by date).
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
I wrote this a while ago, its not a script but it updates the computer objects in AD with that sort of Data
Updating Domain Computer Objects with User and Machine Information
</P>
Updating Domain Computer Objects with User and Machine Information
</P>
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Hi ObDa,
The LastUseTime is all the same even for the AD account that is no longer active?
The LastUseTime is all the same even for the AD account that is no longer active?
Only passing through WMI information ...
LastUseTime is the date of ntuser.dat in the user's profile, so that might come from some AV that opens and scans the user's registry.
LastUseTime is the date of ntuser.dat in the user's profile, so that might come from some AV that opens and scans the user's registry.
Yes, that does make sense.
Thank you for the detailed explanation.
Thank you for the detailed explanation.
Both code snippets are good approaching from different angles:
https://www.experts-exchange.com/questions/29222136/How-do-I-find-a-list-of-all-domain-users-logged-into-a-workstation-timestamp.html#a43325535 (Senior IT) provides a complete time log, while https://www.experts-exchange.com/questions/29222136/How-do-I-find-a-list-of-all-domain-users-logged-into-a-workstation-timestamp.html#a43328296 (oBdA) results in a per-user timestamp.
Both should be accepted.
https://www.experts-exchange.com/questions/29222136/How-do-I-find-a-list-of-all-domain-users-logged-into-a-workstation-timestamp.html#a43325535 (Senior IT) provides a complete time log, while https://www.experts-exchange.com/questions/29222136/How-do-I-find-a-list-of-all-domain-users-logged-into-a-workstation-timestamp.html#a43328296 (oBdA) results in a per-user timestamp.
Both should be accepted.