查询计算机列表-输出上次登录的用户和上次登录日期 [英] Query list of computers - output last logged on user and last logon date
问题描述
我正在创建一个脚本,以从.txt文件中检索所有计算机名称,然后查询它们;
I am creating a script to retrieve all the machine names from a .txt file then Query against them;
ComputerName
UserName(最后一个用户的名称)登录到计算机)
上次登录/使用的日期
ComputerName UserName (Of the last person to logon to the machine) Date it was last Logged on to/Used
Clear-Host
$machines = Get-Content -Path C:\Users\khalifam\Desktop\Winver\MachineNames.txt
ForEach ($Compu in $machines) {
Get-WmiObject –ComputerName $machines –Class Win32_ComputerSystem | Select
Username, PSComputerName | FT
}
推荐答案
作为旁注:
- 参数名称的连字符不是连字符,而是 En-Dash es,所以我收集这段代码是从互联网上的某个地方复制的
- 在循环中您使用了错误的变量ComputerName参数应该为
$ Compu
- the hyphens for the parameter names are not hyphens, but En-Dashes, so I gather this code is copied from the internet somewhere
- inside the loop you are using the wrong variable on the ComputerName parameter which should be
$Compu
我曾经说过, 't认为您可以从WMI Win32_ComputerSystem类中获取所需的信息。.
您需要做的是从计算机事件日志中解析该信息:
Having said that, I don't think you can get the info you need from the WMI Win32_ComputerSystem class..
What you will need to do is to parse the info from the computers eventlog:
# get an array of computernames loaded from the text file
$machines = Get-Content -Path C:\Users\khalifam\Desktop\Winver\MachineNames.txt
$result = foreach ($computer in $machines) {
# test if the compurer is on-line
if (!(Test-Connection -ComputerName $computer -Count 1 -Quiet)) {
Write-Warning "Computer '$computer' is off-line."
# skip this computer and carry on with the next iteration
continue
}
# search the computers eventlog and parse the username and last logon time from that
# you can play around with other values for -MaxEvents if you feel you're missing information.
Get-WinEvent -ComputerName $computer -FilterHashtable @{Logname='Security';ID=4672} -MaxEvents 20 |
Where-Object { $_.Properties[1].Value -notmatch 'SYSTEM|NETWORK SERVICE|LOCAL SERVICE' } |
Select-Object @{Name ='ComputerName'; Expression = {$_.MachineName}},
@{Name ='UserName'; Expression = {$_.Properties[1].Value}},
@{Name ='LastLogon'; Expression = {$_.TimeCreated}} -First 1
}
# show on screen:
$result | Format-Table -AutoSize
# save as CSV file
$result | Export-Csv -Path 'D:\LastLogonInfo.csv' -NoTypeInformation
更新
如果我正确理解了您的评论,则需要列出所有用户的列表(少数用户除外),并检索他们的<在列表中的计算机上登录strong>最新。
If I understand your comment correctly, you would like a list of all users (except for a few) and retrieve their latest login on a computer from the list.
在这种情况下,您可以执行以下操作:
In that case you can do the following:
# get an array of computernames loaded from the text file
$machines = Get-Content -Path C:\Users\khalifam\Desktop\Winver\MachineNames.txt
$result = foreach ($computer in $machines) {
# test if the compurer is on-line
if (!(Test-Connection -ComputerName $computer -Count 1 -Quiet)) {
Write-Warning "Computer '$computer' is off-line."
# skip this computer and carry on with the next iteration
continue
}
# you do not want to include these account logins
$exclude = '\$|SYSTEM|NETWORK SERVICE|LOCAL SERVICE|KHALIFAM'
# search the computers eventlog and parse the username and last logon time from that
# you can play around with other values for -MaxEvents if you feel you're missing information.
Get-WinEvent -ComputerName $computer -FilterHashtable @{Logname='Security';ID=4672} -MaxEvents 100 |
Where-Object { $_.Properties[1].Value -notmatch $exclude } |
Select-Object @{Name ='ComputerName'; Expression = {$_.MachineName}},
@{Name ='UserName'; Expression = {$_.Properties[1].Value}},
@{Name ='LastLogon'; Expression = {$_.TimeCreated}} |
Group-Object -Property UserName | ForEach-Object {
$_.Group | Sort-Object LastLogon -Descending | Select-Object -First 1
}
}
# show on screen:
$result | Format-Table -AutoSize
# save as CSV file
$result | Export-Csv -Path 'D:\LastLogonInfo.csv' -NoTypeInformation
这篇关于查询计算机列表-输出上次登录的用户和上次登录日期的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!