How can I generate a list of last user logon times for a domain?

A. I've written a small bit of VBScript which using the Windows Scripting engine can be used to generate a list of all user last logons (if the last logon time is not available the user will be omitted). You will need Windows Scripting Host installed, see 'What is the Windows Scripting Host' for more information.

Save the following text into file userlogin.vbs

' List last logon times
' 2001-03-27 John Savill, Jakob Hussfelt http://www.ntfaq.com
On Error Resume Next
sEnterDCs = "SAVILLTECH,SAVILLNT02"
sObjects = Split(sEnterDCs, ",")
Set oDomain = GetObject("WinNT://" & sObjects(0))
oDomain.Filter = Array("User")
WScript.Echo "Showing last login times of accounts from: " & oDomain.Name & vbNewLine
For Each oDomainItem In oDomain
  sUsrLogin = oDomainItem.LastLogin
  If UBound(sObjects) >= 1 Then
    For ii = 1 To UBound(sObjects)
      Set oUsr = GetObject("WinNT://" & sObjects(ii) & "/" & oDomainItem.Name & ",user")
      If oUsr.LastLogin > sUsrLogin Then sUsrLogin = oUsr.LastLogin
    Next
  End If
  WScript.Echo "Username: " & Left(oDomainItem.Name & Space(22),22) & "Last login: " & FormatDateTime(sUsrLogin)
Next

In line 'set oDomain = GetObject("WinNT://SAVILLTECH")' you should change SAVILLTECH to your domain name.

To run type the following:

C:\> cscript userlogin.vbs

Below is a sample output:

C:\>cscript d:\temp\disuser.vbs
Microsoft (R) Windows Scripting Host Version 5.0 for Windows
Copyright (C) Microsoft Corporation 1996-1997. All rights reserved.

Domain : SAVILLTECH
Full Name=Maria Aala (DIS 120 inactive)Last login=27/05/1999 14:44:24
Full Name=Paul J AaronLast login=16/08/1999 13:01:56
Full Name=Hany A AbbasLast login=23/08/1999 13:25:46
Full Name=Tony S AbbittLast login=27/08/1999 15:07:20
Full Name=Adnan AbdallahLast login=16/07/1999 10:34:58
Full Name=Tony AbelaLast login=21/07/1999 10:43:20
Full Name=Juan Claudio AbelloLast login=25/06/1999 11:15:32
Full Name=Marie J B AbreyLast login=07/09/1999 08:00:34
Full Name=Philippa AbsilLast login=07/09/1999 06:33:18
Full Name=Ace Test account for NetID - Alistair PurvisLast login=28/01/1999 07:5
4:30
Full Name=Chris AckermannLast login=07/09/1999 08:21:20
Full Name=Curtis S AdamsLast login=10/08/1999 12:32:02
Full Name=Helen R Adams DIS user left 27.8.99Last login=02/08/1999 08:52:58
Full Name=Michael Adams Dis 4.6.99 NMFLast login=03/06/1999 08:50:10
Full Name=Philip R AdamsLast login=14/06/1999 12:49:00

The advantage of using VBScript is you can change the code to output exactly what you want but don't mail me asking for help changing it!

In the above example it only checks with the PDC. If you have BDC's these values may be wrong as last logon times are not updated from BDC's to the PDC. You may want to update the script to also query the BDC's and display the latest time (if anyone does this feel free to mail it to me and I'll update the FAQ).

You can also use USRSTAT.EXE from the resource kit.

End of Article