So I have all the once_logged_in profiles listed in C:\Users folder but I need to find out when was the last time these users logged in onto the same computer locally or remotely with their domain user credentials. Is their any easy way to reach this goal? I mean scripts in PS or batch commands, wmi, anything. Unfortunately event log auditing is not on.
Asked
Active
Viewed 314 times
1 Answers
0
This might work for you:
net user username /domain| findstr "Last"
Edit
Looks like this reports back the last time anything, as that user, signed into that domain, but it's uncorrolated with that computer.
If you have GPOs you could add a sign-on script that just writes a text file with the logon time. Here's a guide for that: https://community.spiceworks.com/how_to/82-monitor-user-log-in-and-log-off-without-3rd-party-software
If that doesn't seem viable, maybe a bit more information about what you're trying to get done would open up some other options.
T M
- 21
- 3
-
This doesn`t give the right result. It gets some information from the domain. When users are accessing different things. Can be even false for that one. I tried and after some hours I re-ran the query for the same user and gave an older date not newer.:D Needs something which does for local machine... – Steve Aug 26 '21 at 14:56