Author Posts

January 1, 2012 at 12:00 am

by teknomor at 2013-02-25 09:49:36

Hello I am trying to create a simple reg query to find out the last logged on user to a remote PC
This is my first use of powershell so please excuse my ignorance if this is a simple answer

$User = reg query \\TestPC\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI /v LastLoggedOnUser
$User |Out-file "C:\Test.txt"

This all works fine but what I need and I am not sure how to parse the data properly is just the SAMAccountName

Current data returned to the text file is
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI
LastLoggedOnUser REG_SZ Domain\User

What my final result would be in the text file would be "user"
I thought the returned value would be a string and I could parse based on the domain\ and just retrieve the data after that.

Any help would be appreciated

Thank you

by nohandle at 2013-02-25 13:29:42

(Get-ItemProperty -Path HKLM:\software\microsoft\windows\CurrentVersion\Authentication\LogonUI -Name LastLoggedOnUser).lastLoggedOnUser

Hi, try this.

by teknomor at 2013-02-26 05:55:42

Thank you for your reply and suggestion Jakub. It is appreciated.