General
cancel
Showing results for 
Search instead for 
Did you mean: 

Is there a command similar to UX "last" to use agains a TS?

SOLVED
Go to solution
Edgar Zapata
Esteemed Contributor

Is there a command similar to UX "last" to use agains a TS?

I need a command or tool similar to "last" to see on which servers a given user was last logged.
Either that or, if I run the command on a given server, which users where logged on to that given server.

Thank you much.
6 REPLIES
Ivan Ferreira
Honored Contributor

Re: Is there a command similar to UX "last" to use agains a TS?

I don't know about any native windows command that could do that, but logons are registered to the security event log. If your system is w2k3 based, you could try with eventquery, like this:

eventquery -V -L security /FI "source eq security AND id eq 500".

Then you can use another program like perl to filter the data (Not too easy like unix isn't it)
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?
Edgar Zapata
Esteemed Contributor

Re: Is there a command similar to UX "last" to use agains a TS?

Ivan,
thank you.
I'll check out and get back with feedback.
slds.
Jon Finley
Honored Contributor
Solution

Re: Is there a command similar to UX "last" to use agains a TS?

Try the following link, it gives an example using WSH.

http://www.windowsitpro.com/Article/ArticleID/15113/15113.html


In case the link goes away though....

Save the following text into file userlogin.vbs

' List last logon times
' 2001-03-27 John Savill, Jakob Hussfelt http://www.ntfaq.com
On Error Resume Next
sEnterDCs = "SAVILLTECH,SAVILLNT02"
sObjects = Split(sEnterDCs, ",")
Set oDomain = GetObject("WinNT://" & sObjects(0))
oDomain.Filter = Array("User")
WScript.Echo "Showing last login times of accounts from: " & oDomain.Name & vbNewLine
For Each oDomainItem In oDomain
sUsrLogin = oDomainItem.LastLogin
If UBound(sObjects) >= 1 Then
For ii = 1 To UBound(sObjects)
Set oUsr = GetObject("WinNT://" & sObjects(ii) & "/" & oDomainItem.Name & ",user")
If oUsr.LastLogin > sUsrLogin Then sUsrLogin = oUsr.LastLogin
Next
End If
WScript.Echo "Username: " & Left(oDomainItem.Name & Space(22),22) & "Last login: " & FormatDateTime(sUsrLogin)
Next

In line 'set oDomain = GetObject("WinNT://SAVILLTECH")' you should change SAVILLTECH to your domain name.

To run type the following:

C:\> cscript userlogin.vbs


Jon
"Do or do not. There is no try!" - Yoda
Edgar Zapata
Esteemed Contributor

Re: Is there a command similar to UX "last" to use agains a TS?

Jon,
thank you much.
This is what I was looking for.
I didn't get it to work, though.
It didn't retrieve any record.

Regards.
Jon Finley
Honored Contributor

Re: Is there a command similar to UX "last" to use agains a TS?

Hmmm... It worked for me:

Showing last login times of accounts from: 11XEDDTC

Username: aceweb Last login: 12/14/2005 12:35:15 PM
Username: aconner Last login: 10/26/2004 4:59:59 PM
Username: Administrator Last login: 10/26/2004 4:59:59 PM
Username: ahonker Last login: 1/23/2006 9:57:18 AM
Username: ajmaster Last login: 1/23/2006 11:32:23 AM
Username: ajvalent Last login: 1/23/2006 11:07:04 AM
Username: akwood Last login: 1/23/2006 10:26:32 AM
Username: apinst Last login: 1/23/2006 11:35:30 AM


Make sure that on the domain line, that you change it to your DC's:

sEnterDCs = "11XEDDTC,CEATCBDC"

And run the vbs file with credentials that have privledges on the DC's.

Jon
"Do or do not. There is no try!" - Yoda
Edgar Zapata
Esteemed Contributor

Re: Is there a command similar to UX "last" to use agains a TS?

It worked fine for me too after making some changes to the original VBS script.

I also ran this command for a particular user; See the output here:

net user ezapata /domain | findstr /i logon
Logon script
Last logon 7/28/2008

Thought it could be of help.

Tnks.