42 lines
1.4 KiB
PowerShell
42 lines
1.4 KiB
PowerShell
|
function Get-LastLoginTimes {
|
||
|
|
|
||
|
|
[CmdletBinding()]
|
||
|
|
param (
|
||
|
|
[Parameter()]
|
||
|
|
[String]
|
||
|
|
$ComputerName = $ENv:COMPUTERNAME
|
||
|
|
)
|
||
|
|
|
||
|
|
$sb = {
|
||
|
|
$profiles = Get-CimInstance -Class Win32_UserProfile
|
||
|
|
$profiles | Where {$_.SID.length -gt 10} | Foreach-Object {
|
||
|
|
|
||
|
|
$sid = $_.SID
|
||
|
|
$prop = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$sid\"
|
||
|
|
if($prop.LocalProfileUnLoadTimeHigh -and $prop.LocalProfileUnLoadTimeLow){
|
||
|
|
$a = '{0:x}' -f $prop.LocalProfileUnLoadTimeHigh
|
||
|
|
$b = '{0:x}' -f $prop.LocalProfileUnLoadTimeLow
|
||
|
|
$dec = [bigint]::Parse("$a$b",'AllowHexSpecifier')
|
||
|
|
$time = w32tm /ntte $dec
|
||
|
|
$lastTime = [datetime]($time -split ' - ')[1]
|
||
|
|
}
|
||
|
|
else{
|
||
|
|
$lastTime = $null
|
||
|
|
}
|
||
|
|
|
||
|
|
[PSCustomObject]@{
|
||
|
|
Name = ($_.LocalPath -split 'C:\\Users\\')[1]
|
||
|
|
LocalPath = $_.LocalPath
|
||
|
|
LastLoginTime = $lastTime
|
||
|
|
}
|
||
|
|
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if($ComputerName -eq $ENv:COMPUTERNAME){
|
||
|
|
Invoke-Command -ScriptBlock $sb | Sort-Object LastLoginTime -Descending
|
||
|
|
}
|
||
|
|
else{
|
||
|
|
Invoke-Command -ComputerName $ComputerName -ScriptBlock $sb | Select-Object Name, LocalPath, LastLoginTime | Sort-Object LastLoginTime -Descending
|
||
|
|
}
|
||
|
|
|
||
|
|
}
|