Home page logo

basics logo Security Basics mailing list archives

Re: Question about Active Directory and last time user has logged on
From: "Nikhil Wagholikar" <visitnikhil () gmail com>
Date: Thu, 30 Aug 2007 10:23:23 +0530

Hello Mary Hendrix,

Here is a useful stuff I found on Google search:

Here is a small bit of VBScript which using the Windows Scripting
engine can be used to generate a list of all user last logons (if the
last logon time is not available the user will be omitted):

Save the following text into file userlogin.vbs

' List last logon times
' 2001-03-27 John Savill, Jakob Hussfelt http://www.ntfaq.com
On Error Resume Next
sObjects = Split(sEnterDCs, ",")
Set oDomain = GetObject("WinNT://" & sObjects(0))
oDomain.Filter = Array("User")
WScript.Echo "Showing last login times of accounts from: " &
oDomain.Name & vbNewLine
For Each oDomainItem In oDomain
  sUsrLogin = oDomainItem.LastLogin
  If UBound(sObjects) >= 1 Then
    For ii = 1 To UBound(sObjects)
      Set oUsr = GetObject("WinNT://" & sObjects(ii) & "/" &
oDomainItem.Name & ",user")
      If oUsr.LastLogin > sUsrLogin Then sUsrLogin = oUsr.LastLogin
  End If
  WScript.Echo "Username: " & Left(oDomainItem.Name & Space(22),22) &
"Last login: " & FormatDateTime(sUsrLogin)

In line 'set oDomain = GetObject("WinNT://SAVILLTECH")' you should
change SAVILLTECH to your domain name.

To run type the following:

C:\> cscript userlogin.vbs

You can also use USRSTAT.EXE from the resource kit.

More Information:

Nikhil Wagholikar
Information Security Analyst
NII Consulting
Web: http://www.niiconsulting.com

On 8/29/07, Mary Hendrix <maryhendrix () gmail com> wrote:
Is there a way to find out the last time a user has logged into a domain?

Thanks in advance


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]