Skip to content

Instantly share code, notes, and snippets.

@breezhang
Created February 20, 2012 07:12
Show Gist options
  • Save breezhang/1868227 to your computer and use it in GitHub Desktop.
Save breezhang/1868227 to your computer and use it in GitHub Desktop.
Last Logon Times (Vista .. win7)
#source="http://blogs.technet.com/b/heyscriptingguy/archive/2012/02/19/use-powershell-to-find-last-logon-times-for-virtual-#workstations.aspx?utm_source=twitterfeed&utm_medium=twitter"
$Computer = 'NJLT-Service'
$Win32OS = Get-WmiObject -Class Win32_OperatingSystem -ComputerName $Computer
$Build = $Win32OS.BuildNumber
#The “If ($Build -ge 6001)” is the first decision point.
#if the build number is 6001 and above, the script block will run.
if ($Build -ge 6001)
{
$Win32User = Get-WmiObject -Class Win32_UserProfile -ComputerName $Computer
#I am using RegEx to filter the LocalService, NetworkService, and System profiles because
#they aren’t needed, and I am sorting by LastUseTime to pick the one most recently used.
$Win32User = $Win32User | Where-Object {($_.SID -notmatch "^S-1-5-\d[18|19|20]$")}
$Win32User = $Win32User | Sort-Object -Property LastUseTime -Descending
$LastUser = $Win32User | Select-Object -First 1
#The Win32_UserProfile Loaded property determines
#if the user was logged on at the time the query was run.
#I’m casting that value into a new variable ($Loaded).
#I will create a New-Object with that property and value later.
$Loaded = $LastUser.Loaded
#So now we’re looking at the LastUseTime property—the value is a “System.String”
#(20120209035107.508000+000),
#but I need to convert it to a “System.DateTime” object,
#so it’s readable, I will use the WMI ConvertToDateTime method to accomplish this.
$Time = ([WMI] '').ConvertToDateTime($LastUser.LastUseTime)
#One of the things I need to do is take the SID that is collected
#via Win32_UserProfile and convert it to Domain\samAccountName format.
#So I created a New-Object with the
#.NET Security Identifier class Provider,
#and I specified the $LastUser.SID variable.
$UserSID = New-Object System.Security.Principal.SecurityIdentifier($LastUser.SID)
#When New-Object is created with the SID value,
#there is a translate method that can be used to convert the SID to the Domain\samAccountName.
$User = $UserSID.Translate([System.Security.Principal.NTAccount])
#Instead of using Write-Host or some string-type output,
#I prefer to use object-based output.
#The following code snippet shows the four pieces of information
#that I wanted to gather and return.
$UserProf = New-Object PSObject -Property @{
Computer=$Computer
User=$User
Time=$Time
CurrentlyLoggedOn=$Loaded
}
}
#If you’ve ever created custom objects in Windows PowerShell,
#you know that without any special XML formatting,
#when you return the object,
#it will place the properties in an order that you may not like.
#To quickly remedy this, what I usually do is pipe my variable
#that contains the custom object to Select-Object and type the names of the properties
#in the order in which I want them returned.
$UserProf = $UserProf | Select-Object Computer, User, Time, CurrentlyLoggedOn
$UserProf
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment