Check Last Login Time for AD Users

There is another How-To for a script to constantly run and part of a GPO. This is a basic VBScript that can be run on demand from your desktop to query a domain controller for last login times and how to save it to a file.

	Create VBScript file Make a new .txt document and save it as userlogin1.vbs
	Copy and paste the following: ' List last logon times On Error Resume Next sEnterDCs = "DOMAINCONTROLLER" sObjects = Split(sEnterDCs, ",") Set oDomain = GetObject("WinNT://" & sObjects(0)) oDomain.Filter = Array("User") WScript.Echo "Showing last login times of accounts from: " & oDomain.Name & vbNewLine For Each oDomainItem In oDomain sUsrLogin = oDomainItem.LastLogin If UBound(sObjects) >= 1 Then For ii = 1 To UBound(sObjects) Set oUsr = GetObject("WinNT://" & sObjects(ii) & "/" & oDomainItem.Name & ",user") If oUsr.LastLogin > sUsrLogin Then sUsrLogin = oUsr.LastLogin Next End If WScript.Echo "Username: " & Left(oDomainItem.Name & Space(22),22) & "Last login: " & FormatDateTime(sUsrLogin) Next
	Change sEnterDCs = "DOMAINCONTROLLER" Change "DOMAINCONTROLLER" to the name of your DC (make sure you leave the quotation marks).
	Save the file Save the file. If you have multiple DCs then repeat steps 1 -3 for each domain controller and save .vbs accordingly.
	Open CMD Prompt Open a command window and browse to where the .vbs files are saved. Enter in the following command: cscript userlogin.vbs>dc1.txt (.xls, .doc, etc.)
	Wait... Depending on the size of your domain, this process should only take a minute or two. Once it completes (it'll go back to the prompt) you can open the saved file and view your report.

Conclusion

While not the easiest or an automated process, it's nice to have this handy should your boss ask for the information. I have the scripts created and ready to go should I get requested to check login times.