Find When a user last logged in

Question

I am trying to figure out a way to look at all of the AD user accounts on a specific computer and then see how long its been since each of them last signed into that specific computer. I found a PS script to do this but the problem was that it would show the last time those users logged into AD in general, not that specific computer. To add some context I will have to use the script to purge local AD users from computers who haven't re logged into that specific computer for 90 days. Also I'm fairly new to PS. Thanks in advanced for anyone who helps!

Old script:

$data = @() 
$NetLogs = Get-WmiObject Win32_NetworkLoginProfile -ComputerName "PC-NAME";
foreach ($NetLog in $NetLogs) { 
if ($NetLog.LastLogon -match "(\d{14})") { 
$row = "" | Select Name,LogonTime 
$row.Name = $NetLog.Name 
$row.LogonTime=[datetime]::ParseExact($matches[0], "yyyyMMddHHmmss", $null) 
$data += $row
} 
} 
$data

Where I got the old script:

http://xpertkb.com/find-lastlogon-date-server-local-domain-users/

Answer 1

The way to do it is execute a logon script that records date, username and hostname every time a user logs on to the domain; you can set this in Active Directory. You would then only need to parse this centralized log location where you save this information.

Another possibility is parsing the Domain Controller log, but this has proven slow and impractical for us.

You could check the file C:\Users\<user>\NTUSER.DAT: if its last modified date is older than 90 days...zap the profile!