This is my personal blog. The opinions and views I express are my own. The information I provide is on an as-is basis. I make no representations as to accuracy, completeness, currentness, suitability, or validity of any information on this blog and will not be liable for any errors, omissions, or delays in this information or any losses, injuries or damages arising from its use.

Get the last user logged in (Powershell)


This script connects to the c$ admin share using the Get-ChildItem cmdlet and looks at the LastWriteTime value of the user profile folder in the C:\users in order to determine who logged in last to the machine. The script collects the Computer name, Username and the LastWriteTime of the users’ profile.

This is not the most elegant way to do it but it seems to work since Microsoft has no built-in method to get the last user that logged in to a particular machine.

# On error the script will continue silently without 
$erroractionpreference = "SilentlyContinue"

# TXT file containing the computers your pinging
$testcomputers = gc -Path "C:\scripts\computers.txt"

# Looking through the txt file above and counting computer names.
$test_computer_count = $testcomputers.Length;
$x = 0;

write-host -foregroundcolor cyan ""
write-host -foregroundcolor cyan "Testing $test_computer_count computers, this may take a while."

# Testing Connections
foreach ($computer in $testcomputers) {
        # I only send 2 echo requests to speed things up, if you want the defaut 4 
        # delete the -count 2 portion
   if (Test-Connection -ComputerName $computer -Quiet -count 2){
        # The path to the livePCs.txt file, change to meet your needs
        Add-Content -value $computer -path c:\scripts\livePCs.txt
        # The path to the deadPCs.txt file, change to meet your needs
        Add-Content -value $computer -path c:\scripts\deadPCs.txt
    $testcomputer_progress = [int][Math]::Ceiling((($x / $test_computer_count) * 100))
	# Progress bar
    Write-Progress  "Testing Connections" -PercentComplete $testcomputer_progress -Status "Percent Complete - $testcomputer_progress%" -Id 1;

write-host -foregroundcolor cyan ""
write-host -foregroundcolor cyan "Testing Connection complete"
write-host -foregroundcolor cyan ""
# End Testing Connections

$ComputerName = gc -Path "C:\scripts\livePCs.txt"

$computer_count = $ComputerName.Length;
# The results of the script are here
$exportLocation = "C:\scripts\loggedInUser.csv"
$i = 0;
 foreach ($Computer in $ComputerName){
   $Bios =get-wmiobject win32_bios -Computername $Computer
   $Networks = Get-WmiObject Win32_NetworkAdapterConfiguration -ComputerName $Computer | ? {$_.IPEnabled}
   $username = Get-ChildItem "\\$computer\c$\Users" | Sort-Object LastWriteTime -Descending | Select Name, LastWriteTime -first 1

   $computer_progress = [int][Math]::Ceiling((($i / $computer_count) * 100))
	# Progress bar
    Write-Progress  "Gathering Hardware Info" -PercentComplete $computer_progress -Status "Processing Computers - $computer_progress%" -Id 1;
   foreach ($Network in $Networks) {
    $OutputObj  = New-Object -Type PSObject
    $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.ToUpper()
    $OutputObj | Add-Member -MemberType NoteProperty -Name UserName -Value $username.Name
    $OutputObj | Add-Member -MemberType NoteProperty -Name Last-Login -Value $username.LastWriteTime
    $OutputObj | Export-Csv $exportLocation -Append

 write-host -foregroundcolor cyan "Script is complete, the results are here: $exportLocation"


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.