PowerShell for Windows Admins

Aug 15 2018   8:23AM GMT

user logon time

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Tags:
CIM
Powershell
WMI

Saw an interesting question about user logon time. How can you tell the logged on user and when they logged on

$logon = Get-CimInstance -ClassName Win32_LogonSession |
sort StartTime -Descending |
select -First 1

$user = Get-CimAssociatedInstance -InputObject $logon -ResultClassName Win32_Account

$props = [ordered]@{
Name = $user.Fullname
UserId = $user.Name
Domain = $user.Domain
LocalAccount = $user.LocalAccount
LogonTime = $logon.StartTime
}

New-Object -TypeName PSobject -Property $props

Start by getting the last logon session using Win32_LogonSession. Use that to find the associated account using Get-CimAssociatedInstance and the Win32_Account class.

Pull together the output you want and create an object to display.

This deliberately only takes the latest logon and deals with that

 Comment on this Post

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

Share this item with your network: