Powershell lastlogon and lastlogontimestamp

Fraismikki 1 Reputation point
2021-08-02T04:55:29.14+00:00

Hello, i need help on a powershell script. I have this script where it gets the lastlogon attribute of users on al DC, and outputs the latest, however, there are some users that have the lastlogontimestamp as the latest.

I would like to modify the script below that it will query for noth lastlogon and lastlogontimestamp and outputs the latest.

=====================================

function Get-ADUsersLastLogon()
{
$dcs = Get-ADDomainController -Filter {Name -like "*"}
$OUpath = '<OUPath>'
$users = Get-ADUser -Filter {Enabled -eq $true} -SearchBase $OUpath
$time = 0
$exportFilePath = "c:\tmp\lastLogontest.csv"
$columns = "Name,LastLogon"

Out-File -filepath $exportFilePath -force -InputObject $columns

foreach($user in $users)
{
foreach($dc in $dcs)
{
$hostname = $dc.HostName
$currentUser = Get-ADUser $user.SamAccountName | Get-ADObject -Server $hostname -Properties lastLogon

  if($currentUser.LastLogon -gt $time) 
  {
    $time = $currentUser.LastLogon
  }
}

$dt = [DateTime]::FromFileTime($time).ToString('dd/MM/yyyy hh:mm:ss tt')
$row = $user.Name+","+$dt

Out-File -filepath $exportFilePath -append -noclobber -InputObject $row

$time = 0

}
}

Get-ADUsersLastLogon

Apprciate yourr kind help,
Fraismikki

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,404 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Ian Xue (Shanghai Wicresoft Co., Ltd.) 31,091 Reputation points Microsoft Vendor
    2021-08-02T06:53:24.537+00:00

    Hi,

    Since your script queries the lastlogon property on all the DCs, there is no need to query the lastlogontimestamp property because lastlogon is greater than or equals lastlogontimestamp in any case.

    Understanding the AD Account attributes - LastLogon, LastLogonTimeStamp and LastLogonDate

    Best Regards,
    Ian Xue

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments

  2. Rich Matheisen 45,111 Reputation points
    2021-08-02T15:17:53.193+00:00

    The LastLogonTimestamp may, or may not, be at all relevant. The LastLogon (on the DC that last authenticated the user) should be one to rely on. If you're finding a LastLogonTimeStamp whose value is later than any of the LastLogon values you may be missing a DC in your queries.

    I took the liberty of neatening your code. In future, if you post code, please use the "Code Sample" editor (it's the icon with the "101 010" text, the 5th from the left side, or use "Ctrl+K"). The "text" editor mangles code! It's difficult and error-prone to separate the text from the code, too.

    function Get-ADUsersLastLogon() {
        $dcs = Get-ADDomainController -Filter { Name -like "*" } |
            Select-Object -ExpandProperty HostName
        $OUpath = '<OUPath>'
        $exportFilePath = "c:\tmp\lastLogontest.csv"
    
        Get-ADUser -Filter { Enabled -eq $true } -SearchBase $OUpath |
            Select-Object -ExpandProperty distinguishedName |
                ForEach-Object {
                    $time = 0
                    foreach ($dc in $dcs) {
                        $currentUser = Get-ADUser -Identity $_ -Server $dc -Properties lastLogon
                        if ($currentUser.LastLogon -gt $time) {
                            $time = $currentUser.LastLogon
                        }
                    }
                    [PSCustomObject]@{
                        LastLogon = [DateTime]::FromFileTime($time).ToString('dd/MM/yyyy hh:mm:ss tt')
                        Name      = $currentUser.Name
                    }
                } | Export-Csv $exportFilePath -NoTypeInformation
    }
    Get-ADUsersLastLogon
    
    0 comments No comments