| Function Get-LastLoggedOnUser { [CmdletBinding()] Param( [parameter(Mandatory=$true, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] [String[]] $ComputerName ) BEGIN { # Place all private functions here. # Main Object Creation Function New-CustomObject { $Obj = New-Object -TypeName PSObject -Property @{ "ComputerName" = $Null "Online" = $False "TimeStamp" = $Null "DomainUser" = $Null "DomainSID" = $Null "LocalUser" = $Null } $obj.PSObject.TypeNames.Insert(0,'Object') Write-Output $Obj } # END: Function New-CustomObject } # END: BEGIN BLOCK PROCESS { # Get a fresh copy of the output object. $CustomeObject = New-CustomObject # Cycle through each client and process. ForEach ($C in $ComputerName) { Write-Verbose "Connecting to: $C" # Initialize the output data. $Data = $CustomeObject # Add the name of the current client being processed to the Object. $Data.ComputerName = $C # Add the current timestamp. $Data.TimeStamp = Get-Date Try { # Establish the PowerShell Session $SO = New-PSSessionOption -OpenTimeout 500 -NoMachineProfile $SessionHash = @{ "ComputerName" = $C "SessionOption" = $SO "ErrorAction" = "Stop" } # Establish the new session. $S = New-PSSession @SessionHash # Execute on the remote client. $Hash = @{ "Session" = $S } $Data = Invoke-Command -Session $S -ScriptBlock { Param ($Obj, $Fixed) # Set the ComputerName. $Obj.ComputerName = HostName # Mark the client as being "Online" $Obj.Online = $True $Splat = @{ "Path" = "HKLM:\Software\Microsoft\windows\currentVersion\Authentication\LogonUI" "ErrorAction" = "SilentlyContinue" } # Get the last Domain User to log on. $Obj.DomainUser = Get-ItemProperty @Splat -Name LastLoggedOnUser | Select -ExpandProperty LastLoggedOnUser # Get the last Domain SID to log on. $Obj.DomainSID = Get-ItemProperty @Splat -Name LastLoggedOnUserSid | Select -ExpandProperty LastLoggedOnUserSid $Splat = @{ "Path" = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" "ErrorAction" = "SilentlyContinue" } # Get the last local account to log on. $Obj.LocalUser = Get-ItemProperty @Splat -Name DefaultUserName | Select-Object -ExpandProperty DefaultUsername # End of remote commands. ------------------------------------- # Return the object to the calling client. Write-Output $Obj } -ArgumentList $Data # Remove the PS Session. $S | Remove-PSSession Write-Verbose "Finished processing: $C" } # END: TRY BLOCK Catch { Write-Verbose "Error connecting to: $C." $Data.ComputerName = $C } # END: CATCH BLOCK # Write the data to the pipeline. Write-Output $Data } } # END: PROCESS BLOCK END { } # END: END BLOCK <# .SYNOPSIS Gets the last logged on Domain and local user on a client. .DESCRIPTION Gets the last logged on domain user and the last local account used to log on to a client. .PARAMETER ComputerName The name of the client to recover drive information from. .EXAMPLE Get-LastLoggedOnUser -ComputerName PHX-cl1, PHX-CL2 LocalUser : admin TimeStamp : 4/9/2015 3:40:51 PM DomainUser : MCTExpert\jyoder Online : True ComputerName : PHX-CL1 DomainSID : S-1-5-21-442550829-505139508-2737514282-1605 PSComputerName : lon-cl1 RunspaceId : 0bba2b2c-97df-4e32-94dc-cbc045db7a92 LocalUser : admin TimeStamp : 4/9/2015 3:40:52 PM DomainUser : MCTExpert\administrator Online : True ComputerName : PHX-CL2 DomainSID : S-1-5-21-442550829-505139508-2737514282-500 PSComputerName : LON-CL2 RunspaceId : 9f122008-d0da-4d40-9d4a-a81f2ba4c7b3 Returns information concerning the last logged on users for clients PHX-CL1 and PHX-CL2. .EXAMPLE "PHX-cl1", "PHX-CL2" | Get-LastLoggedOnUser Returns information concerning the last logged on users for clients PHX-CL1 and PHX-CL2. .EXAMPLE "PHX-cl1", "PHX-CL2" | Get-LastLoggedOnUser | Export-CSV -Path D:\PS\Offline.csv Exports the Results to a CSV File. Import-CSV -Path D:\PS\Offline.csv | Where-Object Online -eq $False | Get-LastLoggedOnUser | Export-CSV -Path D:\PS\Offline2.csv Imports the CSV file and filters for all clients that were offline during the previous run of this command. The previous offline clients are processed again and a CSV file is generated so any clients that are still offline can be processed again. .NOTES Requirements: - PowerShell Remoting is enabled. - You are logged on with credentials that allow you to remote to other clients. =============================================================================== == Cmdlet: Get-LastLoggedOnUser == == Author: Jason A. Yoder == == Company: MCTExpert of Arizona == == Date: April 10, 2015 == == Copyright: All rights reserved. == == Version: 1.0.0.0 == == Legal: The user assumes all responsibility and liability for the usage of == == this PowerShell code. MCTExpert of Arizona, Its officers, shareholders, == == owners, and their relatives are not liable for any damages. As with all == == code, review it and understand it prior to usage. It is recommended that == == this code be fully tested and validated in a test environment prior to == == usage in a production environment. == == == == Does this code make changes: NO == =============================================================================== #> } # End Get-LastLoggedOnUser | 
