function Get-LastLoginTimes { [CmdletBinding()] param ( [Parameter()] [String] $ComputerName = $ENv:COMPUTERNAME ) $sb = { $profiles = Get-CimInstance -Class Win32_UserProfile $profiles | Where-Object {$_.SID.length -gt 10} | Foreach-Object { $sid = $_.SID $prop = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$sid\" if($prop.LocalProfileUnLoadTimeHigh -and $prop.LocalProfileUnLoadTimeLow){ $dec2 = 0 $a = '{0:x}' -f $prop.LocalProfileUnLoadTimeHigh $b = '{0:x}' -f $prop.LocalProfileUnLoadTimeLow $dec1 = [bigint]::Parse("$a$b",'AllowHexSpecifier') if($prop.LocalProfileLoadTimeHigh -and $prop.LocalProfileLoadTimeLow){ $c = '{0:x}' -f $prop.LocalProfileLoadTimeHigh $d = '{0:x}' -f $prop.LocalProfileLoadTimeLow $dec2 = [bigint]::Parse("$c$d",'AllowHexSpecifier') } if ($dec2 -gt $dec1) { $dec = $dec2 } else { $dec = $dec1 } $time = w32tm /ntte $dec $lastTime = [datetime]($time -split ' - ')[1] } else{ $lastTime = $null } [PSCustomObject]@{ Name = ($_.LocalPath -split 'C:\\Users\\')[1] LocalPath = $_.LocalPath LastLoginTime = $lastTime } } } if($ComputerName -eq $ENv:COMPUTERNAME){ Invoke-Command -ScriptBlock $sb | Sort-Object LastLoginTime -Descending } else{ Invoke-Command -ComputerName $ComputerName -ScriptBlock $sb | Select-Object Name, LocalPath, LastLoginTime | Sort-Object LastLoginTime -Descending } }