Reg Query

This topic contains 0 replies, has 1 voice, and was last updated by Profile photo of Forums Archives Forums Archives 5 years, 3 months ago.

  • Author
    Posts
  • #5589

    by teknomor at 2013-02-25 09:49:36

    Hello I am trying to create a simple reg query to find out the last logged on user to a remote PC
    This is my first use of powershell so please excuse my ignorance if this is a simple answer

    $User = reg query \\TestPC\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI /v LastLoggedOnUser
    $User |Out-file "C:\Test.txt"

    This all works fine but what I need and I am not sure how to parse the data properly is just the SAMAccountName

    Current data returned to the text file is
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI
    LastLoggedOnUser REG_SZ Domain\User

    What my final result would be in the text file would be "user"
    I thought the returned value would be a string and I could parse based on the domain\ and just retrieve the data after that.

    Any help would be appreciated

    Thank you

    by nohandle at 2013-02-25 13:29:42

    (Get-ItemProperty -Path HKLM:\software\microsoft\windows\CurrentVersion\Authentication\LogonUI -Name LastLoggedOnUser).lastLoggedOnUser

    Hi, try this.

    by teknomor at 2013-02-26 05:55:42

    Thank you for your reply and suggestion Jakub. It is appreciated.

You must be logged in to reply to this topic.