header image

user logon time

Posted by: | August 15, 2018 Comments Off on user logon time |

Saw an interesting question about user logon time. How can you tell the logged on user and when they logged on


$logon = Get-CimInstance -ClassName Win32_LogonSession |
sort StartTime -Descending |
select -First 1

$user = Get-CimAssociatedInstance -InputObject $logon -ResultClassName Win32_Account

$props = [ordered]@{
Name = $user.Fullname
UserId = $user.Name
Domain = $user.Domain
LocalAccount = $user.LocalAccount
LogonTime = $logon.StartTime

New-Object -TypeName PSobject -Property $props


Start by getting the last logon session using Win32_LogonSession. Use that to find the associated account using Get-CimAssociatedInstance and the Win32_Account class.


Pull together the output you want and create an object to display.


This deliberately only takes the latest logon and deals with that

under: PowerShell and CIM, PowerShell and WMI

Comments are closed.