User Logon time-stamp from Entire directory

PowerShell Help
1

Hi Friends,

I am just beginner for power shell. In My project required list of users lastlogon from AD forest. I am searched multiple forum and i make it my own script.

#Get Domain List from Forest
$csv = “D:\scripts\LastLogon-users.csv”
$users = Get-Content “D:\users.txt”
$array = @()
Import-Module activedirectory
$Domains = (Get-ADForest ‘testlab.com’).Domains

#Search on each domain
foreach($Domain in $Domains)
{

foreach($user in $users) 
{            
	 $svc = Get-ADUser -Filter 'Name -like "$user"' -server '$domain' | Get-ADObject -Properties lastLogontimeStamp
	 $obj = New-Object psobject -Property @{  
	 ADUser = $user          
	 UserName = $svc.SamAccountName            
	 LastLogonTimeStamp = $svc.LastLogonTimeStamp                  
	 }            
$array += $obj            
}

}
$array | export-csv $CSV -NoTypeInformation

I am getting below error . can you someone please help on this.
[b]
[blockquote]{Get-ADUser : Invalid URI: The server name ‘$domain’ could not be parsed. You might need to enable internationalized dom
ain name support for class System.Uri. See help of class System.Uri for more details.
At D:\Scripts\Get-Users-LastLogon.ps1:16 char:21

  •      $svc = Get-ADUser <<<<  -Filter "Name -like "$user"" -server "$domain" | Get-ADObject -Properties lastLogont

imeStamp
+ CategoryInfo : InvalidType: [:] [Get-ADUser], UriFormatException
+ FullyQualifiedErrorId : Invalid URI: The server name "$domain" could not be parsed. You might need to enable int
ernationalized domain name support for class System.Uri. See help of class System.Uri for more details.,Microsoft.
ActiveDirectory.Management.Commands.GetADUser}[/blockquote][/b]

Edit : Issue has been fixed by change this line "Get-ADUser -Filter 'Name -like $user' -server $domain | Get-ADObject -Properties lastLogontimeStamp"

2

Hey Senthild,

I don’t have an AD to hand to properly test the code, but first thing I notice is :

$svc = Get-ADUser -Filter 'Name -like "$user"' -server '$domain' | Get-ADObject -Properties lastLogontimeStamp

Using a variable name in single quotes will mean the variable isn’t expanded. It’s just taken as literal text.

There might be more work required, but could you try changing the single quotes to double quotes :

$svc = Get-ADUser -Filter 'Name -like "$user"' -server "$domain" | Get-ADObject -Properties lastLogontimeStamp

and see if that fixes it?

3

Thanks for help Tim.

But I already fixed my self by changing the line

 Get-ADUser -Filter "Name -like $user" -server $domain | Get-ADObject -Properties lastLogontimeStamp
4 
Get-ADUser -Filter "Name -like $user" -server $domain -properties LastLogonTimeStamp
works for me. but I prefer LastLogonDate
5

If you want the last logon date, it is better to extract it out from “Lastlogon” property. You could convert that into the date format using “[datetime]::FromFileTime()”. You could use the same method to convert the lastlogontimestamp property as well, but lastlogon is the exact lastlogon date.

PS C:\> $a = Get-ADUser -Filter {Name -like "testuser"} | Get-ADObject -Properties *

PS C:\> $a.lastLogon
130633956664751992

PS C:\> [datetime]::FromFileTime($a.lastLogon)  

Thursday, December 18, 2014 10:31:06 PM

PS C:\> $a.lastLogonTimestamp
130631669994348696

PS C:\> [datetime]::FromFileTime($a.lastLogonTimestamp)

Tuesday, December 16, 2014 6:59:59 AM
6

As GJ states, lastLogon is more accurate since it is updated every time a user logs on.

lastLogonTimestamp is only updated once each 9-14 Days by default.

However, an important thing to also note is that lastLogon is not replicated. For an accurate value you have to query every domain controller and use the highest value.