How to find the last 10 login user IDs and timestamps in SharePoint 2016 on premises using PowerShell

Question

we are using SharePoint 2016 On premises version in our organization,

we need usage details of the sites in sharepoint along with the last accessed time & user Id details. we need to know who viewed the sites and when they accessed it last time,their user ID and timestamp.

Helps us how to find, if any script is there, please share.

Answer 1

Hi @C Pradeep,

Thank you for posting in this community.

Please try to use the Merge-SPUsageLog cmdlet. Here is an example PowerShell script that retrieves the last 10 login user IDs and timestamps:

Merge-SPUsageLog -StartTime (Get-Date).AddDays(-1) -EndTime (Get-Date) | ? { $_.EventId -eq "14" } | Select-Object -First 10 | Select-Object UserDisplayName, Timestamp | Sort-Object Timestamp -Descending

This script retrieves the usage logs from the last day, filters for login events (EventId 14), selects the first 10 results, and sorts them by timestamp in descending order. The output will include the user display name and timestamp for each login event.

References:

• Using Administrative Actions logging in SharePoint Server 2016

Hope this helps.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.