Hello everybody.

I've got a script where I find out who is the logged on user for a specific PC. The script looks like this:

PS> Gwmi Win32_ComputerSystem -Comp "pcname"

This "script" works perfectly fine, but what if I want to (if there is no user logged on at the moment) find out which user that logged on last?

This information is stored in the registry and it's possible to extract it from there using .VBS so it should be possible with PowerShell too.

Any suggestions?

This will give you the time and date of the last logon. It will show any successful logon including being unlocked. To show all records remove | select -First from the end

$data = @()
$profiles = GWMI Win32_NetworkLoginProfile -ComputerName COMPUTER_NAME
foreach ($profile in $profiles){
$date = $profile.LastLogon
if ($date -ne $null -and $date -ne "**************.******+***") {
$row = "" | Select User,LogonTime
$year = $date.SubString(0,4)
$month = $date.SubString(4,2)
$day = $date.SubString(6,2)
$hour = $date.SubString(8,2)
$min = $date.SubString(10,2)
$sec = $date.Substring(12,2)
$row.User = $Profile.Name
$row.LogonTime = Get-Date -Date ($month + "/" + $day + "/" + $year + " " + $hour + ":" + $min + ":" + $sec)
$data += $row
}
}
$data | Sort -Descending LogonTime | select -First

Cruisader03 nailed it already, but I'd offer a slightly more streamlined approach using the datetime parse method, and V2 new-object Property parameter.

$name = '.' Get-WmiObject Win32_NetworkLoginProfile -ComputerName $name| #Filter out any non valid DTG Where-Object {$_.LastLogon -match "(?\d{14}\.\d{6}\S)(?\d+)$"}| #Foreach valid entry find the last logon dtg ForEach-Object { # Win32_NetworkLoginProfile formats the utc offset in seconds this # Breaks the DateTime parser. We reformat the string converting # the offset back to hours $CorrectedDTG = "{0}{1:00}" -f $matches.dtg, ($matches.offset/60) New-Object PSObject -Property @{ Name=$_.Name LogonTime=[datetime]::ParseExact($CorrectedDTG, "yyyyMMddhhmmss.ffffffzz", $null) } } | Sort-Object -Descending LogonTime | Select-Object -First 1

~Glenn

Adapting the .Net [DateTime] and cleaning up. This is now VERY clean. Thx glnsize:

$data = @()

$NetLogs = Get-WmiObject Win32_NetworkLoginProfile

foreach ($NetLog in $NetLogs) {
if ($NetLog.LastLogon -match "(\d{14})") {
$row = "" | Select Name,LogonTime
$row.Name = $NetLog.Name
$row.LogonTime=[datetime]::ParseExact($matches[0], "yyyyMMddHHmmss", $null)
$data += $row
}
}

$data

I couldn't help myself and played with it just for fun.

Get-WmiObject Win32_NetworkLoginProfile |
    Sort -Descending LastLogon |
    Select * -First 1 |
    ? {$_.LastLogon -match "(\d{14})"} |
        % {
            New-Object PSObject -Property @{
                Name=$_.Name ;
                LastLogon=[datetime]::ParseExact($matches[0], "yyyyMMddHHmmss", $null)
            }
        }