0

I am retrieving the last logged on user using the script below - whilst I can get a list of the accounts, I only need to retrieve those that contain the "domain" name, and not accounts from the "local server name".

$Users = Get-WmiObject Win32_LoggedOnUser -ComputerName $ADComputer |
         Select Antecedent -Unique 
\\.\root\cimv2:Win32_Account.Domain="LocalServer",Name="SYSTEM"
\\.\root\cimv2:Win32_Account.Domain="LocalServer",Name="NETWORK SERVICE"  
\\.\root\cimv2:Win32_Account.Domain="Domain",Name="user1"

So I am only expecting it to return

\\.\root\cimv2:Win32_Account.Domain="Domain",Name="user1"

I have tried the following:

$Users | Select $_.Antecedent | Where {$_.Antecedent.name -like "user1"}

But this returns blank. How can I select this line only? In addition, I want to ultimately return "user1" in my results.

Ansgar Wiechers
  • 193,178
  • 25
  • 254
  • 328
TOGEEK
  • 711
  • 4
  • 15
  • 34

1 Answers1

0

try something like this

  Get-WmiObject Win32_LoggedOnUser -ComputerName $ADComputer  | where { ($_.Antecedent -split "=")[2] -like "*user1*" } |  select @{N="Name";ex={($_.Antecedent -split "=")[2]}}
Esperento57
  • 16,521
  • 3
  • 39
  • 45