Active Directory (AD) is a critical component for IT administrators to manage users and devices in a network. 🚀 One common requirement is to generate reports on the last sign-in activity for users and devices in AD. 🔄 In this guide, I will show you how to use PowerShell to achieve this efficiently. 🔧

📄 Prerequisites

To follow this guide, you need:

1. 💻 PowerShell installed on your system (version 5.1 or later).

2. 📝 Active Directory PowerShell module installed.

3. 🔒 Appropriate permissions to query Active Directory.

🔢 PowerShell Commands to Get Last Sign-In Reports

1. 👤 For Users

The following command retrieves all users in Active Directory along with their last logon time:

# Get all users and their last logon time
Get-ADUser -Filter * -Property DisplayName, SamAccountName, LastLogonTimestamp |
Select-Object DisplayName, SamAccountName, @{Name="LastLogon"; Expression={[datetime]::FromFileTime($_.LastLogonTimestamp)}} |
Export-Csv -Path "C:\Reports\UsersLastSignIn.csv" -NoTypeInformation -Encoding UTF8

• 🔍 What It Does:

  • Get-ADUser: Retrieves user information from AD.

  • -Filter *: Fetches all users.

  • LastLogonTimestamp: Retrieves the last logon time for each user.

  • Export-Csv: Exports the results to a CSV file for review.

• 📈 Output: The command generates a CSV file named UsersLastSignIn.csv in the C:\Reports directory.

2. 📚 For Devices

Similarly, use the command below to get the last sign-in details for devices:

# Get all computers and their last logon time
Get-ADComputer -Filter * -Property Name, LastLogonTimestamp |
Select-Object Name, @{Name="LastLogon"; Expression={[datetime]::FromFileTime($_.LastLogonTimestamp)}} |
Export-Csv -Path "C:\Reports\DevicesLastSignIn.csv" -NoTypeInformation -Encoding UTF8

• 🔍 What It Does:

  • Get-ADComputer: Retrieves computer information from AD.

  • LastLogonTimestamp: Retrieves the last logon time for each device.

  • Export-Csv: Saves the output to a CSV file named DevicesLastSignIn.csv.

📊 Understanding the Commands

• 🔹 LastLogonTimestamp vs. LastLogon:

  • LastLogonTimestamp: Replicated across domain controllers but may be up to 14 days old.

  • LastLogon: Real-time but requires querying all domain controllers.

• 🔹 File Path: You can change the file path (C:\Reports\) to save the report to your preferred directory.

🚨 Benefits of Using PowerShell

• ⏳ Time-Saving: Automates a manual task.

• 🎨 Customizable: You can add or remove properties as needed.

• 📄 Portable Reports: The CSV files can be easily shared and analyzed.

📚 Conclusion

Using PowerShell to get reports on the last sign-in activity for users and devices in Active Directory is a straightforward and powerful approach. 🚀 These commands not only provide valuable insights but also save time by automating repetitive tasks.

Try these commands in your environment and let me know in the comments if you have any questions or suggestions! 😊

Tags: 🔧 PowerShell, 🔰 Active Directory, 🔒 IT Administration, 🌐 Last Logon Report, ⚙️ Automation