Created
February 20, 2012 07:12
-
-
Save breezhang/1868227 to your computer and use it in GitHub Desktop.
Last Logon Times (Vista .. win7)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#source="http://blogs.technet.com/b/heyscriptingguy/archive/2012/02/19/use-powershell-to-find-last-logon-times-for-virtual-#workstations.aspx?utm_source=twitterfeed&utm_medium=twitter" | |
$Computer = 'NJLT-Service' | |
$Win32OS = Get-WmiObject -Class Win32_OperatingSystem -ComputerName $Computer | |
$Build = $Win32OS.BuildNumber | |
#The “If ($Build -ge 6001)” is the first decision point. | |
#if the build number is 6001 and above, the script block will run. | |
if ($Build -ge 6001) | |
{ | |
$Win32User = Get-WmiObject -Class Win32_UserProfile -ComputerName $Computer | |
#I am using RegEx to filter the LocalService, NetworkService, and System profiles because | |
#they aren’t needed, and I am sorting by LastUseTime to pick the one most recently used. | |
$Win32User = $Win32User | Where-Object {($_.SID -notmatch "^S-1-5-\d[18|19|20]$")} | |
$Win32User = $Win32User | Sort-Object -Property LastUseTime -Descending | |
$LastUser = $Win32User | Select-Object -First 1 | |
#The Win32_UserProfile Loaded property determines | |
#if the user was logged on at the time the query was run. | |
#I’m casting that value into a new variable ($Loaded). | |
#I will create a New-Object with that property and value later. | |
$Loaded = $LastUser.Loaded | |
#So now we’re looking at the LastUseTime property—the value is a “System.String” | |
#(20120209035107.508000+000), | |
#but I need to convert it to a “System.DateTime” object, | |
#so it’s readable, I will use the WMI ConvertToDateTime method to accomplish this. | |
$Time = ([WMI] '').ConvertToDateTime($LastUser.LastUseTime) | |
#One of the things I need to do is take the SID that is collected | |
#via Win32_UserProfile and convert it to Domain\samAccountName format. | |
#So I created a New-Object with the | |
#.NET Security Identifier class Provider, | |
#and I specified the $LastUser.SID variable. | |
$UserSID = New-Object System.Security.Principal.SecurityIdentifier($LastUser.SID) | |
#When New-Object is created with the SID value, | |
#there is a translate method that can be used to convert the SID to the Domain\samAccountName. | |
$User = $UserSID.Translate([System.Security.Principal.NTAccount]) | |
#Instead of using Write-Host or some string-type output, | |
#I prefer to use object-based output. | |
#The following code snippet shows the four pieces of information | |
#that I wanted to gather and return. | |
$UserProf = New-Object PSObject -Property @{ | |
Computer=$Computer | |
User=$User | |
Time=$Time | |
CurrentlyLoggedOn=$Loaded | |
} | |
} | |
#If you’ve ever created custom objects in Windows PowerShell, | |
#you know that without any special XML formatting, | |
#when you return the object, | |
#it will place the properties in an order that you may not like. | |
#To quickly remedy this, what I usually do is pipe my variable | |
#that contains the custom object to Select-Object and type the names of the properties | |
#in the order in which I want them returned. | |
$UserProf = $UserProf | Select-Object Computer, User, Time, CurrentlyLoggedOn | |
$UserProf |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment