How to tell systems which are accessed by a user

Hi,

I am kind of new to PwoerShell. I am thinking to use the Get-WinEvent or Get-EventLog for the following requirement:

  • Per user-specfied machine (running Windows 10):
    • Get (from event log or somewhere else) all other computers on the network accessed by user(s)
I am not sure if there is a chance anyone would know of the route to do this. Thanks.

Brian

Did you try to search for this? I am pretty sure you’re not the first with this requirement.

PowershellGallery, Technet Script Gallery or Microsoft Powershell Forum or Microsoft Scripting Guys forum or even here in this forum

This is a common use case.

Yet, being new to PS is fine, but, that means you really need to get ramped up. Spend the necessary time on YouTube, Microsoft Virtual Academy, Microsoft Learn, MSDN Channel9 and search for beginning powershell, intermediate powershell, advanced powershell, PowerShell GUI, PowerShell forms, PowerShell using .Net, PowerShel WMI, PowerShell CIM, PowerShell Active Directory, etc…

A simple web search using you use case would have given you this almost immediately.

Get All AD Users Logon History with their Logged on Computers (with IPs)& OUs This script will list the AD users logon information with their logged on computers by inspecting the Kerberos TGT Request Events(EventID 4768) from domain controllers. Not Only User account Name is fetched, but also users OU path and Computer Accounts are retrieved. https://gallery.technet.microsoft.com/scriptcenter/Get-All-AD-Users-Logon-9e721a89