Retrieve the Computer lastlogintimestamp?

Forums

My Profile

Inbox

Address Book

My Subscription

My Forums

Retrieve the Computer lastlogintimestamp?

Logged in as: Guest

arrSession:exec spGetSession 2,5,64851

	Active Users: There are 0 members and 0 guests.
	Users viewing this topic: none

Printable Version

All Forums >> [Scripting] >> Windows PowerShell >> Retrieve the Computer lastlogintimestamp?
Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks!

Page: [1]

Message

<< Older Topic Newer Topic >>

Retrieve the Computer lastlogintimestamp? - 10/7/2008 1:42:28 AM

marcussmith

Posts: 7
Score: 0
Joined: 1/30/2006
Status: offline

Hi all

How would I use powershell to..

Read a list computers from text file and retrieve the Computer lastlogintimestamp? and output to a text file.

I have the first part.

$file ="C:\Timestamps.txt"
$Computers = Gc "C:\List.txt"
ForEach($MachineName In $Computers)

Thanks

< Message edited by marcussmith -- 10/7/2008 1:47:32 AM >

Post #: 1

RE: Retrieve the Computer lastlogintimestamp? - 10/8/2008 2:03:56 AM

SAPIENScripter

Posts: 276
Score: 2
Joined: 11/1/2006
From: SAPIEN Technologies
Status: offline

You will need some method of getting the computer object from your domain and then a method of converting the lastlogon value to a meaningful date. Overall your process can look like this:

get-content c:\list.txt | foreach { My-Function $_ } | out-file $file

If your list has the complete DN, that simplifies things. Can you use the Quest AD cmdlets? That too will simplify things. The real challenge here is the My-Function piece. If you use ADSI to get the object , you'll need to convert the lastlogon value. This function should help with that:

Function Get-UTCAge {
   #get date time of the last password change
       Param([int64]$Last=0)
       if ($Last -eq 0) {
           write 0
       } else {
           #clock starts counting from 1/1/1601.
           [datetime]$utc="1/1/1601"
           #calculate the number of days based on the int64 number
           $i=$Last/864000000000

           #Add the number of days to 1/1/1601
           #and write the result to the pipeline
           write ($utc.AddDays($i))
       }
   } # end Get-UTCAge function

_____________________________

Jeffery Hicks
Windows PowerShell MVP
SAPIEN Technologies - Scripting, Simplified. www.SAPIEN.com

Follow Me: http://www.twitter.com/JeffHicks

(in reply to marcussmith)

Post #: 2

RE: Retrieve the Computer lastlogintimestamp? - 10/8/2008 2:13:45 AM

SAPIENScripter

Posts: 276
Score: 2
Joined: 11/1/2006
From: SAPIEN Technologies
Status: offline

Here's a script you can use

#Get-ComputerAccount.ps1
#v1.0 October 8, 2008
# Jeffery Hicks
# jhicks@sapien.com
# http://blog.sapien.com
#---------------------------------------------------------------------------------------

# Usage: get-computeraccount.ps SERVER02

#sample output
# Name                : XPDESK01
# DN                  : CN=XPDESK01,OU=Enterprise Servers,DC=bigcompany,DC=local
# Description         :
# AccountCreated      : 2/25/2008 3:22:10 PM
# AccountModified     : 9/30/2008 5:40:00 PM
# LastLogon           : 10/8/2008 2:08:45 PM
# PasswordLastChanged : 9/8/2008 1:36:17 PM
# PasswordAge         : 29
# 
# IMPORTANT:
# This script requires a Windows 2003 or later domain.

#  ****************************************************************
#  * DO NOT USE IN A PRODUCTION ENVIRONMENT UNTIL YOU HAVE TESTED *
#  * THOROUGHLY IN A LAB ENVIRONMENT. USE AT YOUR OWN RISK.       *                     
#  ****************************************************************
#---------------------------------------------------------------------------------------
 
Param ([string]$computername=$env:computername)
 
#define some functions used in the script
#get the age of the password in days
#a value of 0 means just set or needs to be set
#the value of $LastSet will be a large integer
#indicating the number seconds since 1/1/1601
#since the password was set

Function Get-UTCAge {
   #get date time of the last password change
       Param([int64]$Last=0)
       if ($Last -eq 0) {
           write 0
       } else {
           #clock starts counting from 1/1/1601.
           [datetime]$utc="1/1/1601"
           #calculate the number of days based on the int64 number
           $i=$Last/864000000000
           
           #Add the number of days to 1/1/1601
           #and write the result to the pipeline
           write ($utc.AddDays($i))
       }
   } # end Get-UTCAge function

Function Get-PwdAge {

Param([int64]$LastSet=0) 
 
 
   if ($LastSet -eq 0) {
       write "0"
   } else {
       #get the date the password was last changed
       [datetime]$ChangeDate=Get-UTCAge $LastSet
       
       #get the current date and time
       [datetime]$RightNow=Get-Date
       
       #write the difference in days
       write $RightNow.Subtract($ChangeDate).Days
   }
} #end Get-PwdAge function
       
#main code
#define some constants

#define our searcher object
$Searcher = New-Object DirectoryServices.DirectorySearcher

$filter="(&(objectCategory=computer)(cn=$computername))"
$searcher.filter=$filter

$searcher.findall() | ForEach-Object {

#create a custom object for the account and password properties
   $obj=New-Object PSObject
   
   #add properties to the object
   $obj | Add-Member -MemberType NoteProperty -Name "Name" -Value $_.properties.item("name")[0]
   $obj | Add-Member -MemberType NoteProperty -Name "DN" -Value $_.properties.item("distinguishedname")[0]
   $obj | Add-Member -MemberType NoteProperty -Name "Description" -Value $_.properties.item("description")[0]
   $obj | Add-Member -MemberType NoteProperty -Name "AccountCreated" -Value $_.properties.item("whencreated")[0]
   $obj | Add-Member -MemberType NoteProperty -Name "AccountModified" -Value $_.properties.item("WhenChanged")[0]
   $obj | Add-Member -MemberType NoteProperty -Name "LastLogon" -Value (Get-UTCAge $_.properties.item("lastlogon")[0])
   $obj | Add-Member -MemberType NoteProperty -Name "PasswordLastChanged" -Value (Get-UTCAge $_.properties.item("pwdlastset")[0])
   $obj | Add-Member -MemberType NoteProperty -Name "PasswordAge" -Value (Get-PwdAge $_.properties.item("pwdlastset")[0])

#write object to the pipeline
   write $obj
   
} #end foreach

#end of script

It writes a custom object to the pipeline so you should be able to do:

get-content c:\list.txt | foreach { c:\scripts\get-computeraccount $_ | Select name,lastLogon} | out-file $file

_____________________________

Jeffery Hicks
Windows PowerShell MVP
SAPIEN Technologies - Scripting, Simplified. www.SAPIEN.com

Follow Me: http://www.twitter.com/JeffHicks

(in reply to marcussmith)

Post #: 3

RE: Retrieve the Computer lastlogintimestamp? - 10/21/2008 12:54:44 AM

marcussmith

Posts: 7
Score: 0
Joined: 1/30/2006
Status: offline

Hi Sapien,

Thanks for you reply I achieved my result the easy way in the end. I installed the QuestAD extras and ran the below.

$PingMachines = Gc "C:\CompList.txt"

ForEach($MachineName In $PingMachines)

      {

   Get-QADComputer $MachineName -IncludeAllProperties | format-table name, lastlogon | out-file c:\Results.txt -append

}

Thanks for your help.

(in reply to SAPIENScripter)

Post #: 4

If you found our site useful please link to us <a href="http://www.visualbasicscript.com">VisualBasicScript.com</a>.

All Forums >> [Scripting] >> Windows PowerShell >> Retrieve the Computer lastlogintimestamp?

Page: [1]

Jump to:

New Messages	No New Messages
Hot Topic w/ New Messages	Hot Topic w/o New Messages
Locked w/ New Messages	Locked w/o New Messages

Post New Thread

Reply to Message

Post New Poll

Submit Vote

Delete My Own Post

Delete My Own Thread

Rate Posts