Find SQL server last used (date time) by ActiveDirectory "sqlsrv" service accout

Welcome Forums General PowerShell Q&A Find SQL server last used (date time) by ActiveDirectory "sqlsrv" service accout

This topic contains 1 reply, has 2 voices, and was last updated by

 
Participant
3 months, 3 weeks ago.

  • Author
    Posts
  • #132509

    Participant
    Topics: 1
    Replies: 0
    Points: -63
    Rank: Member

    Find SQL server last used (date time) by ActiveDirectory "sqlsrv" service account by using powershell

    we have 110 sql server and 38 Dc's

    now i want to find the sql server which is used by Active Directory sqlsrv service account.

    note: I can find date and time when AD "sqlsrv" used in the infra on object attribute by going to dsa.msc

    Please help me to find the sql server name.

    Note: sqlsrv is not local account it is active directory service account

  • #132546

    Participant
    Topics: 2
    Replies: 25
    Points: 167
    Helping Hand
    Rank: Participant

    Without fully writing the whole script for you 🙂 .. this may get you started and point you in the general direction. Always feel free to come back with what you've written so far if you need further assistance\guidance.

    This MS article outlines some of the more useful logon codes to look for in the Security Event log (at the bottom), although it is an old article. May give you pointers to assist your research.

    https://blogs.msdn.microsoft.com/ericfitz/2008/08/20/tracking-user-logon-activity-using-logon-events/

    This rough one liner is just one option to get you the last user logged onto a computer specified by $computer variable. There may well be other methods using other technologies\processes etc.

    Get-WinEvent -Computer $computer -FilterHashtable @{Logname='Security';ID=4672} -MaxEvents 1 | 
    select TimeCreated, @{N='Last User';E={$_.Properties[1].Value}}

    I've used ID 4672 here, as this references any account assigned to an "administrator equiv", more commonly used for service accounts.

    The one-liner I've provided above has the advantage that it should be quite straightforward to embed within a for-each loop that runs through your computer accounts within AD.

The topic ‘Find SQL server last used (date time) by ActiveDirectory "sqlsrv" service accout’ is closed to new replies.

denizli escort samsun escort muğla escort ataşehir escort kuşadası escort