user logon time

Saw an interesting question about user logon time. How can you tell the logged on user and when they logged on

$logon = Get-CimInstance -ClassName Win32_LogonSession |
sort StartTime -Descending |
select -First 1

$user = Get-CimAssociatedInstance -InputObject $logon -ResultClassName Win32_Account

$props = [ordered]@{
Name = $user.Fullname
UserId = $user.Name
Domain = $user.Domain
LocalAccount = $user.LocalAccount
LogonTime = $logon.StartTime
}

New-Object -TypeName PSobject -Property $props

Start by getting the last logon session using Win32_LogonSession. Use that to find the associated account using Get-CimAssociatedInstance and the Win32_Account class.

Pull together the output you want and create an object to display.

This deliberately only takes the latest logon and deals with that

The post user logon time appeared first on PowerShell for Windows Admins.