Last user log-on

  • Thread starter Thread starter Arc J. Thames
  • Start date Start date
A

Arc J. Thames

Is there anyway to find out the last time all of our users logged on without
using auditing? Maybe querying AD?

Arc
 
It's a little tricky in an environment with multiple DCs, since ServerA will
only "remember" the logon time of users who authenticated to ServerA, and
won't have information about anyone who authenticated to ServerB (and vice
versa.) So you'll need to massage the data after you query all of your DCs
using something like this:

(The Microsoft Script Center has all kinds of sample code that you can study
and use to find the solution you need.)
---------------------------------------------
Set objUser = GetObject _
("LDAP://CN=Username,OU=Blah,OU=Blah,OU=Blah,DC=fabri kan,DC=com")
dtmValue = objUser.LastLogin
WScript.echo "LastLogin is: " & dtmValue

---------------------------------------------
Click to expand...
 
I used this 2 or 3 years ago, it worked, was a little slow though.

' List last logio times
'
On Error Resume Next
OutFileName = "Logons.txt"
sEnterDCs = "DC1,DC2,DC3" 'comma seperated list of Domain Controllers
sObjects = Split(sEnterDCs, ",")
Set oDomain = GetObject("WinNT://" & sObjects(0))
oDomain.Filter = Array("User")
WScript.Echo "Showing last login times of accounts from: " & oDomain.Name &
vbNewLine
For Each oDomainItem In oDomain
sUsrLogin = oDomainItem.LastLogin
If UBound(sObjects) >= 1 Then
For ii = 1 To UBound(sObjects)
Set oUsr = GetObject("WinNT://" & sObjects(ii) & "/" &
oDomainItem.Name & ",user")
If oUsr.LastLogin > sUsrLogin Then sUsrLogin = oUsr.LastLogin
Next
End If
Set FileSystem = WScript.CreateObject("Scripting.FileSystemObject")
Set outFile = FileSystem.OpenTextFile(OutFileName,8,-2)
'outFile.Write vbCrLf &
"---------------------------------------------------------------------------------"
& vbCrLf
'OutFile.write "Username: " & Left(oDomainItem.Name & Space(22),22) &
"Last login: " & FormatDateTime(sUsrLogin) & vbCrLf
OutFile.write oDomainItem.Name & vbTab & FormatDateTime(sUsrLogin) &
vbCrLf
'WScript.Echo "Username: " & Left(oDomainItem.Name & Space(22),22) & "Last
login: " & FormatDateTime(sUsrLogin)
Next

OutFile.close

Regards
Mark Dormer
 
Back
Top