Get user logon/logoff history

[emcclure]

I saw this thread and didn't want to hijack it, especially since it's a couple years old: Get logon history

I tried running the commands listed, but when I do it just sits there for me (obviously changing server for my environment).  I'm not quite sure what I'm doing wrong, but the main idea is that we get an idea of when the user last logged in, their access and their permissions.  I was hoping this would work for at least the logon part, but I'm not sure what I'm doing wrong here.

[LucD]

The Get-VIEvent cmdlet can take a long time, especially if you are going back relatively far in time.
I would suggest to start with a small interval (for example 1 day), to check that the code is working.

[emcclure]

Ok thanks for the tip.  So I would change this: $start = (Get-Date).AddMonths(-6) to something else? Is there an AddDays or something to use?

[LucD]

Yes, like this for example

$start = (Get-Date).AddDays(-1)

[emcclure]

Sweet.  That made the script run a lot faster.  Wow it sure gets everyone that's logged in, whether it's a service account, dcui or a user.  Is there a way to filter it so it only grabs logon events from a particular domain only?

[LucD · Accepted solution]

You could do something like this

$events = 'UserLogoutSessionEvent'

$start = (Get-Date).AddDays(-1)

$domain= 'MyDomain'

Get-VIEvent -Start $start -MaxSamples ([int]::MaxValue) |

where { $_ -is [VMware.Vim.UserLogoutSessionEvent] -and $_.UserName -match "^$domain"} |

Select UserName, IPAddress, LoginTime,

@{N = 'LogoutTime'; E = { [DateTime]($_.FullFormattedMessage -replace '.+login time: (.*), number.+', '$1') } }

---------------------------------------------------------------------------------------------------------

Was it helpful? Let us know by completing this short survey here.

[emcclure]

Awesome.  That works perfect.  Thanks so much.