Home / server / Questions / 274167
Accepted
Doltknuckle
Asked: 2011-05-27 10:31:48 +0800 CST

Powershell script to find if a user has logged in since last reboot

  • 772

So I've been working on a Powershell script that needs to detect if an interactive logon has happened since the last reboot. I can force the system to restart before I launch the task, but I'd like to add some intelligence to the script.

Caveats:

  • Must use Powershell.
  • Can't require special power packs or addins.
  • Can't use Active directory commands. (No get-qaduser)

I am able to get the last time the system rebooted already:

$date = Get-WmiObject Win32_OperatingSystem | %{$_.LastBootUpTime} 
$RebootTime = [System.DateTime]::ParseExact($date.split(".")[0],'yyyyMMddHHmmss',$null)

Any ideas? Thanks in advance

login powershell windows-7

1 Answers

  1. Best Answer

    If you're set on using WMI, you can get LastBootUpTime a bit cleaner:

    PS C:\> $wmi = Get-WmiObject -Class Win32_OperatingSystem
PS C:\> $rebootTime = $wmi.ConvertToDateTime($wmi.LastBootUpTime)
PS C:\> $rebootTime
Tuesday, May 24, 2011 3:18:28 PM

    Taking that, we search the Security Event Log, since $rebootTime, for the most recent, successful, eventID 4624 containing Logon Type 2 -- Interactive Logon:

    PS C:\> $entry = Get-EventLog -After $rebootTime -LogName Security | Where-Object {($_.EventID -eq '4624') -and ($_.EntryType -eq 'SuccessAudit') -and ($_.Message | Select-String "Logon Type:\t\t\t2")} | Select-Object -First 1
PS C:\> $lastLogon = $entry.TimeGenerated
PS C:\> $lastLogon
Tuesday, May 24, 2011 3:19:34 PM

    Then, a quick compare:

    PS C:\> $lastLogon -gt $rebootTime
True

    The above code can be dumped into a script and/or executed on a remote computer. I only ran the commands interactively to demonstrate the example output.

    • 4