From Active Directory, I need to generate a list of computers and the users
who last logged into them. I checked joeware.net and other places on the
'net but no luck.
I'd like output to be something like
//computername //lastlogged-inUser //lastLoginTime.
Thanks,
JM
You might want to try the technique from tip 3437 and 3438 in the 'Tips &
Tricks' at
http://www.jsiinc.com
You can use the Active Directory Command Line Tools from a Windows XP domain
member to retrieve the list of computers (tip 6820 in the 'Tips & Tricks' at
http://www.jsiinc.com)
for /f "Tokens=*" %%c in ('dsquery computer -O samid') do (
call :comp %%c
)
goto .....
:comp
set computer=%1
set computer=%computer:$"=%
set computer=\\%computer:"=%
I believe that the computer holds the last logged on user at
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\DefaultUserName, unless you prevent it via policy.
You could use reg.exe from the Support \ Tools folder on your W2K CD-ROM to
retrieve it:
set qry=reg query "%computer%\HKLM\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon" /v DefaultUserName
for /f "Tokens=2*" %%t in ('%qry%^|Findstr /i /L /c:"DefaultUserName"') do (
set user=%%u
)
Lastly, since this is a domain account, the last logon is stored on the
authenticating DC. If the user logged onto another workstation which
authenticated with that same DC, you don't have the time available.
You could get it from the Security event log of the workstation if it is
auditing logons, or from the Event Log of the authenticating DC, using something
like psloglist, tip 4528.
Jerold Schulman
Windows: General MVP
JSI, Inc.
http://www.jsiinc.com