topic Re: Is there a command similar to UX "last" to use agains a TS? in Operating System - Microsoft

Is there a command similar to UX "last" to use agains a TS?

Edgar Zapata — Fri, 20 Jan 2006 06:29:32 GMT

I need a command or tool similar to "last" to see on which servers a given user was last logged.
Either that or, if I run the command on a given server, which users where logged on to that given server.

Thank you much.

Re: Is there a command similar to UX "last" to use agains a TS?

Ivan Ferreira — Fri, 20 Jan 2006 07:10:50 GMT

I don't know about any native windows command that could do that, but logons are registered to the security event log. If your system is w2k3 based, you could try with eventquery, like this:

eventquery -V -L security /FI "source eq security AND id eq 500".

Then you can use another program like perl to filter the data (Not too easy like unix isn't it)

Re: Is there a command similar to UX "last" to use agains a TS?

Edgar Zapata — Fri, 20 Jan 2006 07:47:14 GMT

Ivan,
thank you.
I'll check out and get back with feedback.
slds.

Re: Is there a command similar to UX "last" to use agains a TS?

Jon Finley — Fri, 20 Jan 2006 12:07:59 GMT

Try the following link, it gives an example using WSH.

http://www.windowsitpro.com/Article/ArticleID/15113/15113.html

In case the link goes away though....

Save the following text into file userlogin.vbs

' List last logon times
' 2001-03-27 John Savill, Jakob Hussfelt http://www.ntfaq.com
On Error Resume Next
sEnterDCs = "SAVILLTECH,SAVILLNT02"
sObjects = Split(sEnterDCs, ",")
Set oDomain = GetObject("WinNT://" & sObjects(0))
oDomain.Filter = Array("User")
WScript.Echo "Showing last login times of accounts from: " & oDomain.Name & vbNewLine
For Each oDomainItem In oDomain
sUsrLogin = oDomainItem.LastLogin
If UBound(sObjects) >= 1 Then
For ii = 1 To UBound(sObjects)
Set oUsr = GetObject("WinNT://" & sObjects(ii) & "/" & oDomainItem.Name & ",user")
If oUsr.LastLogin > sUsrLogin Then sUsrLogin = oUsr.LastLogin
Next
End If
WScript.Echo "Username: " & Left(oDomainItem.Name & Space(22),22) & "Last login: " & FormatDateTime(sUsrLogin)
Next

In line 'set oDomain = GetObject("WinNT://SAVILLTECH")' you should change SAVILLTECH to your domain name.

To run type the following:

C:\> cscript userlogin.vbs

Jon

Re: Is there a command similar to UX "last" to use agains a TS?

Edgar Zapata — Mon, 23 Jan 2006 09:15:11 GMT

Jon,
thank you much.
This is what I was looking for.
I didn't get it to work, though.
It didn't retrieve any record.

Regards.

Re: Is there a command similar to UX "last" to use agains a TS?

Jon Finley — Mon, 23 Jan 2006 13:42:08 GMT

Hmmm... It worked for me:

Showing last login times of accounts from: 11XEDDTC

Username: aceweb Last login: 12/14/2005 12:35:15 PM
Username: aconner Last login: 10/26/2004 4:59:59 PM
Username: Administrator Last login: 10/26/2004 4:59:59 PM
Username: ahonker Last login: 1/23/2006 9:57:18 AM
Username: ajmaster Last login: 1/23/2006 11:32:23 AM
Username: ajvalent Last login: 1/23/2006 11:07:04 AM
Username: akwood Last login: 1/23/2006 10:26:32 AM
Username: apinst Last login: 1/23/2006 11:35:30 AM

Make sure that on the domain line, that you change it to your DC's:

sEnterDCs = "11XEDDTC,CEATCBDC"

And run the vbs file with credentials that have privledges on the DC's.

Jon

Re: Is there a command similar to UX "last" to use agains a TS?

Edgar Zapata — Mon, 28 Jul 2008 15:04:01 GMT

It worked fine for me too after making some changes to the original VBS script.

I also ran this command for a particular user; See the output here:

net user ezapata /domain | findstr /i logon
Logon script
Last logon 7/28/2008

Thought it could be of help.

Tnks.