查询计算机列表 - 输出上次登录用户和上次登录日期 [英] Query list of computers - output last logged on user and last logon date

问题描述

我正在创建一个脚本来从 .txt 文件中检索所有机器名称，然后对它们进行查询；

I am creating a script to retrieve all the machine names from a .txt file then Query against them;

计算机名用户名(最后一个登录机器的人)上次登录/使用的日期

ComputerName UserName (Of the last person to logon to the machine) Date it was last Logged on to/Used

Clear-Host
$machines = Get-Content -Path C:UserskhalifamDesktopWinverMachineNames.txt
ForEach ($Compu in $machines) {
    Get-WmiObject –ComputerName $machines –Class Win32_ComputerSystem | Select 
    Username, PSComputerName | FT
}

推荐答案

旁注:

• 参数名称的连字符不是连字符，而是 En-Dashes，所以我收集此代码是从互联网某处复制的
• 在循环中，您在 ComputerName 参数上使用了错误的变量，该变量应该是 $Compu

• the hyphens for the parameter names are not hyphens, but En-Dashes, so I gather this code is copied from the internet somewhere
• inside the loop you are using the wrong variable on the ComputerName parameter which should be $Compu

话虽如此，我认为您无法从 WMI Win32_ComputerSystem 类中获得所需的信息..
您需要做的是解析计算机事件日志中的信息:

Having said that, I don't think you can get the info you need from the WMI Win32_ComputerSystem class..
What you will need to do is to parse the info from the computers eventlog:

# get an array of computernames loaded from the text file
$machines = Get-Content -Path C:UserskhalifamDesktopWinverMachineNames.txt

$result = foreach ($computer in $machines) {
    # test if the compurer is on-line
    if (!(Test-Connection -ComputerName $computer -Count 1 -Quiet)) {
        Write-Warning "Computer '$computer' is off-line."
        # skip this computer and carry on with the next iteration
        continue
    }

    # search the computers eventlog and parse the username and last logon time from that
    # you can play around with other values for -MaxEvents if you feel you're missing information.
    Get-WinEvent -ComputerName $computer -FilterHashtable @{Logname='Security';ID=4672} -MaxEvents 20 | 
        Where-Object { $_.Properties[1].Value -notmatch 'SYSTEM|NETWORK SERVICE|LOCAL SERVICE' } | 
        Select-Object @{Name ='ComputerName'; Expression = {$_.MachineName}},
                      @{Name ='UserName';     Expression = {$_.Properties[1].Value}},
                      @{Name ='LastLogon';    Expression = {$_.TimeCreated}} -First 1

}

# show on screen:
$result | Format-Table -AutoSize

# save as CSV file
$result | Export-Csv -Path 'D:LastLogonInfo.csv' -NoTypeInformation

<小时>更新

如果我正确理解您的评论，您希望获得所有用户(少数除外)的列表，并从列表中检索他们在计算机上的最新登录信息.

If I understand your comment correctly, you would like a list of all users (except for a few) and retrieve their latest login on a computer from the list.

在这种情况下，您可以执行以下操作:

In that case you can do the following:

# get an array of computernames loaded from the text file
$machines = Get-Content -Path C:UserskhalifamDesktopWinverMachineNames.txt
$result = foreach ($computer in $machines) {
    # test if the compurer is on-line
    if (!(Test-Connection -ComputerName $computer -Count 1 -Quiet)) {
        Write-Warning "Computer '$computer' is off-line."
        # skip this computer and carry on with the next iteration
        continue
    }

    # you do not want to include these account logins
    $exclude = '$|SYSTEM|NETWORK SERVICE|LOCAL SERVICE|KHALIFAM'
    # search the computers eventlog and parse the username and last logon time from that
    # you can play around with other values for -MaxEvents if you feel you're missing information.
    Get-WinEvent -ComputerName $computer -FilterHashtable @{Logname='Security';ID=4672} -MaxEvents 100 | 
        Where-Object { $_.Properties[1].Value -notmatch $exclude } | 
        Select-Object @{Name ='ComputerName'; Expression = {$_.MachineName}},
                      @{Name ='UserName';     Expression = {$_.Properties[1].Value}},
                      @{Name ='LastLogon';    Expression = {$_.TimeCreated}} |
        Group-Object -Property UserName | ForEach-Object {
            $_.Group | Sort-Object LastLogon -Descending | Select-Object -First 1
        }
}

# show on screen:
$result | Format-Table -AutoSize

# save as CSV file
$result | Export-Csv -Path 'D:LastLogonInfo.csv' -NoTypeInformation

这篇关于查询计算机列表 - 输出上次登录用户和上次登录日期的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！