Powershell: Get users last logon date from AD

 

The lastlogon time is kept on every domain controller in the AD. So, if you want to find out what the last logon time and dat of u user is, you have to check all the domain controllers.

When you check all the properties of a user using:

You get a lot of information. The most important are:

lastLogon : 130709985039216673
LastLogonDate : 12-3-2015 09:08:56
lastLogonTimestamp : 130706213360820511

The LastLogonDate is the one that is kept on the domain controller and is not replicated to other domain controllers.

The LastLogonTimestamp is the one you need. This is however a format we cannot read but we can convert it to a normal readable value.

First we need to put this into a variable so we can extract the value later.

Next we use the [datetime]::FromFileTime. This converts the unreadable number to a normal format. We do this while using only the value of the variable.

And voila, the correct format is displayed

donderdag 12 maart 2015 09:08:56

 

Leave a Reply

Your email address will not be published. Required fields are marked *