realtimer
asked on
How do I find a list of all domain users logged into a workstation + timestamp?
We have a client that is needing to replace several PCs. We would like to run a registry query or CMD/Powershell script that will show you a list of all domain users last logged into a specific domain workstation. From my research, all the commands show you a single last user logged on, but, I need the entire list + timestamp as we have multiple domain profiles logged into a PC.
For example, a domain PC will have about 6-8 profiles typically, if a easy view showed us that 3 out of 8 have signed in the PC within the past few months, we'll proceed backing up settings/data. If they're not logged in for a high amount of time, our plan was going to be to skip passed that profile.
For example, a domain PC will have about 6-8 profiles typically, if a easy view showed us that 3 out of 8 have signed in the PC within the past few months, we'll proceed backing up settings/data. If they're not logged in for a high amount of time, our plan was going to be to skip passed that profile.
Last Comment
ste5an
You can query the event log of that machine or you can just sort the local users directory by date.
Just open C:\Users and see what profiles are used (sort it by date).
ASKER CERTIFIED SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
I wrote this a while ago, its not a script but it updates the computer objects in AD with that sort of Data
Updating Domain Computer Objects with User and Machine Information
</P>
Updating Domain Computer Objects with User and Machine Information
</P>
SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
Hi ObDa,
The LastUseTime is all the same even for the AD account that is no longer active?
The LastUseTime is all the same even for the AD account that is no longer active?
Only passing through WMI information ...
LastUseTime is the date of ntuser.dat in the user's profile, so that might come from some AV that opens and scans the user's registry.
LastUseTime is the date of ntuser.dat in the user's profile, so that might come from some AV that opens and scans the user's registry.
Yes, that does make sense.
Thank you for the detailed explanation.
Thank you for the detailed explanation.
Both code snippets are good approaching from different angles:
https://www.experts-exchange.com/questions/29222136/How-do-I-find-a-list-of-all-domain-users-logged-into-a-workstation-timestamp.html#a43325535 (Senior IT) provides a complete time log, while https://www.experts-exchange.com/questions/29222136/How-do-I-find-a-list-of-all-domain-users-logged-into-a-workstation-timestamp.html#a43328296 (oBdA) results in a per-user timestamp.
Both should be accepted.
https://www.experts-exchange.com/questions/29222136/How-do-I-find-a-list-of-all-domain-users-logged-into-a-workstation-timestamp.html#a43325535 (Senior IT) provides a complete time log, while https://www.experts-exchange.com/questions/29222136/How-do-I-find-a-list-of-all-domain-users-logged-into-a-workstation-timestamp.html#a43328296 (oBdA) results in a per-user timestamp.
Both should be accepted.
Powershell
Windows PowerShell is a task automation and configuration management framework from Microsoft, consisting of a command-line shell and associated scripting language built on the .NET Framework. PowerShell provides full access to the Component Object Model (COM) and Windows Management Instrumentation (WMI), enabling administrators to perform administrative tasks on both local and remote Windows systems as well as WS-Management and Common Information Model (CIM) enabling management of remote Linux systems and network devices.
27K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
TRUSTED BY
