58 lines
1.9 KiB
PowerShell
58 lines
1.9 KiB
PowerShell
function Get-LastLoginTimes {
|
|
|
|
[CmdletBinding()]
|
|
param (
|
|
[Parameter()]
|
|
[String]
|
|
$ComputerName = $ENv:COMPUTERNAME
|
|
)
|
|
|
|
$sb = {
|
|
$profiles = Get-CimInstance -Class Win32_UserProfile
|
|
$profiles | Where-Object {$_.SID.length -gt 10} | Foreach-Object {
|
|
|
|
$sid = $_.SID
|
|
$prop = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$sid\"
|
|
if($prop.LocalProfileUnLoadTimeHigh -and $prop.LocalProfileUnLoadTimeLow){
|
|
$dec2 = 0
|
|
$a = '{0:x}' -f $prop.LocalProfileUnLoadTimeHigh
|
|
$b = '{0:x}' -f $prop.LocalProfileUnLoadTimeLow
|
|
$dec1 = [bigint]::Parse("$a$b",'AllowHexSpecifier')
|
|
if($prop.LocalProfileLoadTimeHigh -and $prop.LocalProfileLoadTimeLow){
|
|
$c = '{0:x}' -f $prop.LocalProfileLoadTimeHigh
|
|
$d = '{0:x}' -f $prop.LocalProfileLoadTimeLow
|
|
$dec2 = [bigint]::Parse("$c$d",'AllowHexSpecifier')
|
|
}
|
|
if ($dec2 -gt $dec1) {
|
|
$dec = $dec2
|
|
}
|
|
else {
|
|
$dec = $dec1
|
|
}
|
|
$time = w32tm /ntte $dec
|
|
$lastTime = [datetime]($time -split ' - ')[1]
|
|
}
|
|
else{
|
|
$lastTime = $null
|
|
}
|
|
|
|
[PSCustomObject]@{
|
|
Name = ($_.LocalPath -split 'C:\\Users\\')[1]
|
|
LocalPath = $_.LocalPath
|
|
LastLoginTime = $lastTime
|
|
}
|
|
|
|
}
|
|
}
|
|
if($ComputerName -eq $ENv:COMPUTERNAME){
|
|
Invoke-Command -ScriptBlock $sb
|
|
Select-Object Name, LocalPath, LastLoginTime |
|
|
Sort-Object LastLoginTime -Descending
|
|
}
|
|
else{
|
|
Invoke-Command -ComputerName $ComputerName -SessionOption (New-PSSessionOption -NoMachineProfile) -ScriptBlock $sb |
|
|
Select-Object Name, LocalPath, LastLoginTime |
|
|
Sort-Object LastLoginTime -Descending
|
|
}
|
|
|
|
} |