# Find Last Domain Login Location via username

**URL:** <https://forums.powershell.org/t/find-last-domain-login-location-via-username/3689>\
**Category:** PowerShell Help\
**Created:** [January 29, 2015, 2:46am UTC](https://forums.powershell.org/t/find-last-domain-login-location-via-username/3689 "2015-01-29T02:46:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jared-derby](https://avatars.discourse-cdn.com/v4/letter/j/4af34b/32.png) [@jared-derby](https://forums.powershell.org/u/jared-derby)\
**Post date:** [January 29, 2015, 2:46am UTC](https://forums.powershell.org/t/find-last-domain-login-location-via-username/3689/1 "2015-01-29T02:46:36Z")

</div>

I’m looking for some assistance in finding, where a service account last logged into a member server.

Thanks

---

<div class="post-metadata">

**Author:** ![will-anderson](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/will-anderson/32/234_2.png) [@will-anderson](https://forums.powershell.org/u/will-anderson)\
**Post date:** [January 29, 2015, 3:19am UTC](https://forums.powershell.org/t/find-last-domain-login-location-via-username/3689/2 "2015-01-29T03:19:22Z")

</div>

As far as I know, there’s no real direct way to do this. Every script example I’ve seen grabs a list of computers from AD, and then queries the computers for the last logged on user. You might consider running a script against a domain controller’s security logs for a corresponding logon event. I’m away from my lab right now, but I’ll see if I can whip something up. If you don’t have access to a DC though, you might have to go the long way around with querying the machines.

---

<div class="post-metadata">

**Author:** ![\_timpringle](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/_timpringle/32/276_2.png) [@\_timpringle](https://forums.powershell.org/u/_timpringle)\
**Post date:** [January 29, 2015, 4:10am UTC](https://forums.powershell.org/t/find-last-domain-login-location-via-username/3689/3 "2015-01-29T04:10:08Z")

</div>

If you end up needing to query locally, it sounds like something that a PowerShell Workflow is good for.

```
workflow Get-LastLogonDate
{
    Param
    (

        [string[]] $ComputerName

    )

    foreach -parallel ($computer in $ComputerName)
    {
        $result = Get-WmiObject -Class Win32_NetworkLoginProfile -PSComputerName $computer |
        Where-Object -Property Caption -EQ -Value 'usernamehere' |
        Select-Object -ExpandProperty LastLogon
        "$env:computername,$result"
    }
}
```

To use, set the value of the Caption property accordingly, and ensure $computers is an array with the list of servers to be scanned.

```
Get-LastLogonDate -ComputerName $computers
```

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:46pm UTC](https://forums.powershell.org/t/find-last-domain-login-location-via-username/3689/4 "2024-05-16T20:46:27Z")

</div>