User Logon time-stamp from Entire directory

This topic contains 5 replies, has 5 voices, and was last updated by Profile photo of Simon Wåhlin Simon Wåhlin 1 year, 11 months ago.

  • Author
    Posts
  • #21308
    Profile photo of senthild kumar
    senthild kumar
    Participant

    Hi Friends,

    I am just beginner for power shell. In My project required list of users lastlogon from AD forest. I am searched multiple forum and i make it my own script.

    #Get Domain List from Forest
    $csv = "D:\scripts\LastLogon-users.csv"
    $users = Get-Content "D:\users.txt"
    $array = @()
    Import-Module activedirectory
    $Domains = (Get-ADForest 'testlab.com').Domains

    #Search on each domain
    foreach($Domain in $Domains)
    {

    foreach($user in $users)
    {
    $svc = Get-ADUser -Filter 'Name -like "$user"' -server '$domain' | Get-ADObject -Properties lastLogontimeStamp
    $obj = New-Object psobject -Property @{
    ADUser = $user
    UserName = $svc.SamAccountName
    LastLogonTimeStamp = $svc.LastLogonTimeStamp
    }
    $array += $obj
    }
    }
    $array | export-csv $CSV -NoTypeInformation

    I am getting below error . can you someone please help on this.
    [b]
    [blockquote]{Get-ADUser : Invalid URI: The server name '$domain' could not be parsed. You might need to enable internationalized dom
    ain name support for class System.Uri. See help of class System.Uri for more details.
    At D:\Scripts\Get-Users-LastLogon.ps1:16 char:21
    + $svc = Get-ADUser <<<< -Filter "Name -like "$user"" -server "$domain" | Get-ADObject -Properties lastLogont imeStamp + CategoryInfo : InvalidType: [:] [Get-ADUser], UriFormatException + FullyQualifiedErrorId : Invalid URI: The server name "$domain" could not be parsed. You might need to enable int ernationalized domain name support for class System.Uri. See help of class System.Uri for more details.,Microsoft. ActiveDirectory.Management.Commands.GetADUser}[/blockquote][/b] [u][b]Edit : Issue has been fixed by change this line "Get-ADUser -Filter 'Name -like $user' -server $domain | Get-ADObject -Properties lastLogontimeStamp"[/b][/u]

  • #21309
    Profile photo of Tim Pringle
    Tim Pringle
    Participant

    Hey Senthild,

    I don't have an AD to hand to properly test the code, but first thing I notice is :

    $svc = Get-ADUser -Filter 'Name -like "$user"' -server '$domain' | Get-ADObject -Properties lastLogontimeStamp

    Using a variable name in single quotes will mean the variable isn't expanded. It's just taken as literal text.

    There might be more work required, but could you try changing the single quotes to double quotes :

    $svc = Get-ADUser -Filter 'Name -like "$user"' -server "$domain" | Get-ADObject -Properties lastLogontimeStamp

    and see if that fixes it?

  • #21310
    Profile photo of senthild kumar
    senthild kumar
    Participant

    Thanks for help Tim.

    But I already fixed my self by changing the line

     Get-ADUser -Filter "Name -like $user" -server $domain | Get-ADObject -Properties lastLogontimeStamp 
  • #21317
    Profile photo of Matt McNabb
    Matt McNabb
    Participant
    Get-ADUser -Filter "Name -like $user" -server $domain -properties LastLogonTimeStamp

    works for me. but I prefer LastLogonDate

  • #21318
    Profile photo of GJ
    GJ
    Participant

    If you want the last logon date, it is better to extract it out from "Lastlogon" property. You could convert that into the date format using "[datetime]::FromFileTime()". You could use the same method to convert the lastlogontimestamp property as well, but lastlogon is the exact lastlogon date.

    
    PS C:\> $a = Get-ADUser -Filter {Name -like "testuser"} | Get-ADObject -Properties *
    
    PS C:\> $a.lastLogon
    130633956664751992
    
    PS C:\> [datetime]::FromFileTime($a.lastLogon)  
    
    Thursday, December 18, 2014 10:31:06 PM
    
    PS C:\> $a.lastLogonTimestamp
    130631669994348696
    
    PS C:\> [datetime]::FromFileTime($a.lastLogonTimestamp)
    
    Tuesday, December 16, 2014 6:59:59 AM
    
    
  • #21339
    Profile photo of Simon Wåhlin
    Simon Wåhlin
    Participant

    As GJ states, lastLogon is more accurate since it is updated every time a user logs on.

    lastLogonTimestamp is only updated once each 9-14 Days by default.

    However, an important thing to also note is that lastLogon is not replicated. For an accurate value you have to query every domain controller and use the highest value.

You must be logged in to reply to this topic.