Is there a command similar to UX "last" to use agains a TS?

[Edgar Zapata]

I need a command or tool similar to "last" to see on which servers a given user was last logged.
Either that or, if I run the command on a given server, which users where logged on to that given server.

Thank you much.

[Ivan Ferreira]

I don't know about any native windows command that could do that, but logons are registered to the security event log. If your system is w2k3 based, you could try with eventquery, like this:

eventquery -V -L security /FI "source eq security AND id eq 500".

Then you can use another program like perl to filter the data (Not too easy like unix isn't it)

[Edgar Zapata]

Ivan,
thank you.
I'll check out and get back with feedback.
slds.

[Jon Finley · Accepted solution]

Try the following link, it gives an example using WSH.

http://www.windowsitpro.com/Article/ArticleID/15113/15113.html


In case the link goes away though....

Save the following text into file userlogin.vbs

' List last logon times
' 2001-03-27 John Savill, Jakob Hussfelt http://www.ntfaq.com
On Error Resume Next
sEnterDCs = "SAVILLTECH,SAVILLNT02"
sObjects = Split(sEnterDCs, ",")
Set oDomain = GetObject("WinNT://" & sObjects(0))
oDomain.Filter = Array("User")
WScript.Echo "Showing last login times of accounts from: " & oDomain.Name & vbNewLine
For Each oDomainItem In oDomain
sUsrLogin = oDomainItem.LastLogin
If UBound(sObjects) >= 1 Then
For ii = 1 To UBound(sObjects)
Set oUsr = GetObject("WinNT://" & sObjects(ii) & "/" & oDomainItem.Name & ",user")
If oUsr.LastLogin > sUsrLogin Then sUsrLogin = oUsr.LastLogin
Next
End If
WScript.Echo "Username: " & Left(oDomainItem.Name & Space(22),22) & "Last login: " & FormatDateTime(sUsrLogin)
Next

In line 'set oDomain = GetObject("WinNT://SAVILLTECH")' you should change SAVILLTECH to your domain name.

To run type the following:

C:\> cscript userlogin.vbs


Jon

[Edgar Zapata]

Jon,
thank you much.
This is what I was looking for.
I didn't get it to work, though.
It didn't retrieve any record.

Regards.

[Jon Finley]

Hmmm... It worked for me:

Showing last login times of accounts from: 11XEDDTC

Username: aceweb Last login: 12/14/2005 12:35:15 PM
Username: aconner Last login: 10/26/2004 4:59:59 PM
Username: Administrator Last login: 10/26/2004 4:59:59 PM
Username: ahonker Last login: 1/23/2006 9:57:18 AM
Username: ajmaster Last login: 1/23/2006 11:32:23 AM
Username: ajvalent Last login: 1/23/2006 11:07:04 AM
Username: akwood Last login: 1/23/2006 10:26:32 AM
Username: apinst Last login: 1/23/2006 11:35:30 AM


Make sure that on the domain line, that you change it to your DC's:

sEnterDCs = "11XEDDTC,CEATCBDC"

And run the vbs file with credentials that have privledges on the DC's.

Jon

[Edgar Zapata]

It worked fine for me too after making some changes to the original VBS script.

I also ran this command for a particular user; See the output here:

net user ezapata /domain | findstr /i logon
Logon script
Last logon 7/28/2008

Thought it could be of help.

Tnks.