Skip to main content

Finding the Last Logon Time of a Client

So it is a beautiful evening here in Phoenix and I’m sitting behind my computer working.  It’s all good.  Especially when I get to do a little PowerShell and I get to help someone on the side.  So I’m on PowerShell.com and I see that someone needs a little help getting the last logon time for their clients from Active Directory.  He is doing everything right with pulling the correct information from AD.  His goal is to be able to look for all computer objects that have not logged in in the past 60 days. 
This is actually a good example of how to start the creation of a PowerShell tool.  I am going to expand this tool to make it more flexible and to allow the user to ask for a variety of days as opposed to one.  Also, we will output the information in a reusable format.
This command essentially filters the output of Get-ADComputer as long as you include the –Properties LastLogonDate parameter when using Get-ADComputer. The output is unaltered from Get-ADComputer so you can then pipe it to what ever other command that you need.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
100
101
102
103
104

Function Get-StaleClients
{
[CmdletBinding()]
Param (

    [parameter(Mandatory=$true,
                ValueFromPipeline=$true)]
    [Microsoft.ActiveDirectory.Management.ADComputer[]]
    $Computer,

    [parameter(Mandatory=$true)]
    [INT]
    $Days

)

BEGIN
{
    # Create a .NET object with the cutoff
    # date in the past
    $DaysPast = (Get-Date -hour 0 -Minute 0).AddDays(-$Days)
} # END: BEGIN Block

PROCESS
{
    Foreach ($C in $Computer)
    {
        # Verify that the object has a LastLogonDate property.
        If ($C.LastLogonDate -ne [System.DateTime])
        {
            Write-Warning "LastLogonDate property not in the object."
        }
        Else
        {
            $C |
            Where-Object {$_.LastLogonDate -le $DaysPast}
        }
    } # END: Foreach ($C in $ComputerName)
} # END: PROCESS BLOCK

END {} # END: END Block

<#
.SYNOPSIS
Filters all Active Directory computer objects that are past to it and determines
if those clients have logged in within a specific number of days.

.DESCRIPTION
Filters all Active Directory computer objects that are past to it and determines
if those clients have logged in within a specific number of days.

.PARAMETER Computer
The Computer object from Active Directory to examine.

.PARAMETER Days
The number of days since the last logon.

.INPUTS
Microsoft.ActiveDirectory.Management.ADComputer

.EXAMPLE
Get-ADComputer -Filter * -Properties LastLogonDate | Get-StaleClients -Days 15

Filters all computer objects that have not logged in in the past 15 days.

.NOTES
===============================================================================
== Cmdlet: Get-StaleClients                                                  ==
== Author: Jason A. Yoder                                                    ==
== Company: MCTExpert of Arizona                                             ==
== Date: 2015APR06                                                           ==
== Copyright: All rights reserved.                                           ==
== Version: 1.0.0.0                                                          ==
== Legal: The user assumes all responsibility and liability for the usage of ==
== this PowerShell code.  MCTExpert of Arizona, Its officers, shareholders,  ==
== owners, and their relatives are not liable for any damages.  As with all  ==
== code, review it and understand it prior to usage.  It is recommended that ==
== this code be fully tested and validated in a test environment prior to    ==
== usage in a production environment.                                        ==
==                                                                           ==
== Does this code make changes: NO                                           ==
===============================================================================
#>

} # END: Function Get-StaleClients

#Get-ADComputer -Filter * -Properties LastLogonDate|
#    Get-StaleClients -Days 15

#Get-ADComputer -Filter * |
#    Get-StaleClients -Days 15

Get-Help Get-StaleClients -Full



Comments

Popular posts from this blog

How to list all the AD LDS instances on a server

AD LDS allows you to provide directory services to applications that are free of the confines of Active Directory.  To list all the AD LDS instances on a server, follow this procedure: Log into the server in question Open a command prompt. Type dsdbutil and press Enter Type List Instances and press Enter . You will receive a list of the instance name, both the LDAP and SSL port numbers, the location of the database, and its status.

How to run GPResult on a remote client with PowerShell

In the past, to run the GPResult command, you would need to either physically visit this client, have the user do it, or use and RDP connection.  In all cases, this will disrupt the user.  First, you need PowerShell remoting enabled on the target machine.  You can do this via Group Policy . Open PowerShell and type this command. Invoke-Command –ScriptBlock {GPResult /r} –ComputerName <ComputerName> Replace <ComputerName> with the name of the target.  Remember, the target needs to be online and accessible to you.

Error icon when creating a GPO Preference drive map

You may not have an error at all.  Take a look at the drive mapping below. The red triangle is what threw us off.  It is not an error.  It is simply a color representation of the Replace option of the Action field in the properties of the drive mappings. Create action This give you a green triangle. The Create action creates a new mapped drive for users. Replace Action The Replace action gives you a red triangle.  This action will delete and recreate mapped drives for users. The net result of the Replace action is to overwrite all existing settings associated with the mapped drive. If the drive mapping does not exist, then the Replace action creates a new drive mapping. Update Action The Update action will have a yellow triangle. Update will modify settings of an existing mapped drive for users. This action differs from Replace in that it only updates settings defined within the preference item. All other settings remain as configured on the ma...