Find the last logon date of user(s) in Active Directory

hey everyone welcome back to my channel in today's video I'm going to talk about how to find the last logon date of user accounts in active directory tracking the last log on date is crucial for managing user activity and maintaining the security of your environment before we dive into the steps make sure you have the appropriate privileges to query the active directory database let's get started so in the first method I'm going to use active directory users and computers MMC snapping I have already logged into my domain controller but you can perform these steps on your workstation if you have remote server Administration tools rsat tools installed on that workstation back on my domain controller I'm going to click on start and expand Windows administrative tools and open up active directory users and computers you can also type in dsa.msc to open up active directory users in computers I'm going to expand my domain tasty biryani.local so to view the last logon timestamp attribute first you need to enable the advanced features by clicking on view and click on Advanced features I'm going to locate the user account for whom I want to check the last login date so it's in the OU called EU and then users and I'm going to right click on one of these users kathisha and click on properties and click on attribute editor scroll down and you can see last logon timestamp so this attribute indicates the user's last logon date and time including the time zone now with this method you can only see the last logon timestamp for a single user but if you would like to view this attribute for all users in a much better way you need to use Powershell so I'm going to cancel this and close active directory users in computers MMC snapping and I'm going to open up Powershell by right clicking on start and click on Windows Powershell admin so in Powershell if you want to find the last logon date of a specific user you want to use get hyphen 80 user commandlet with the parameter identity and the username which in this case kathy.sha and the property which I want to query which is last log on date and then I'm going to select object expand property last logon date so I'm going to press enter now this command will list the last logon date property of the specified user which in this case is kathy.sha so what if you want to find the last logon date of all users so again I'm going to use the same command this time I'm going to remove the identity and filter for all users by specifying asterisk and I'm going to select the object name comma last log on date so I'm going to press Center all right you can see it displays the name of the account as well as the last logon date of all users so if you want to save the results to a CSV file for further analysis you can use the export hyphen CSV commandlet so again I'm going to use the same command and at the end of the command I'm going to continue with the command export CSV C drive last logon date dot CSV minus node type information press enter and now if I go to C drive you can see the CSV file here last log on date and if I open it it will list all the users with their name and last log on date properties and that's it by regularly monitoring the last logon dates you can easily identify inactive accounts and ensure the security of your active directory environment I hope you find this video helpful if you have any questions or need further assistance please let me know in the comments below don't forget to like this video And subscribe to my channel for more informative content thanks for watching and I will see you in the next video

Channel: vCloudBitsBytes

Views: 2,986

Keywords: ADUC, ADUser, Active Directory, Export-Csv, Get-ADUser, PowerShell, PowerShell cmdlets, Select-Object, last logon date, security, user accounts, user activity, user management, aduc, Get-ADUser -Filter * -Properties LastLogonDate, LastLogonDate, RSAT, Remote Server Administration Tools

Id: 04x_yQbxgXk

Length: 4min 11sec (251 seconds)

Published: Sat Sep 30 2023