Powershell: Get users last logon date from AD
The lastlogon time is kept on every domain controller in the AD. So, if you want to find out what the last logon time and dat of u user is, you have to check all the domain controllers.
When you check all the properties of a user using:
|
1 |
Get-ADUser avanboerum -Properties * |
You get a lot of information. The most important are:
lastLogon : 130709985039216673
LastLogonDate : 12-3-2015 09:08:56
lastLogonTimestamp : 130706213360820511
The LastLogonDate is the one that is kept on the domain controller and is not replicated to other domain controllers.
The LastLogonTimestamp is the one you need. This is however a format we cannot read but we can convert it to a normal readable value.
First we need to put this into a variable so we can extract the value later.
|
1 |
$lastltime = Get-ADUser avanboerum -properties lastlogontimestamp |Select-Object lastlogontimestamp |
Next we use the [datetime]::FromFileTime. This converts the unreadable number to a normal format. We do this while using only the value of the variable.
|
1 |
[datetime]::FromFileTime(($lastltime.lastlogontimestamp)) |
And voila, the correct format is displayed
donderdag 12 maart 2015 09:08:56