The beginnings of a simple script to retrieve LastLogon property data from Win32_NetworkLoginProfile. Both Servers 2019 DataCenter. When I run the script targeting 2 different servers, one server will return the LastLogon data for AD logins while the other will only return data for local logins. Ulitimately the script will rely on LastLogon data consistantly retreived from any server. It all works as expected when run on localhost.
Write-Host "Enter the name of the Server you wish to query: "
$Server = Read-Host
Get-CimInstance -Class Win32_NetworkLoginProfile -ComputerName $Server |
Select-Object -Property LastLogon,Name
#or
Get-WmiObject -Class Win32_NetworkLoginProfile -ComputerName $Server |
Select-Object -Property LastLogon,Name
Sample output from both servers :
Enter the name of the Server you wish to query:
LON-SVR1
LastLogon Name
--------- ----
NT AUTHORITY\SYSTEM
NT AUTHORITY\LOCAL SERVICE
NT AUTHORITY\NETWORK SERVICE
6/14/2021 1:02:53 PM LON-SVR1\Administrator
ADATUM\ida
ADATUM\Administrator
NT AUTHORITY\SYSTEM
NT AUTHORITY\LOCAL SERVICE
NT AUTHORITY\NETWORK SERVICE
20210614130253.000000-420 LON-SVR1\Administrator
ADATUM\ida
ADATUM\Administrator
PS E:\mod01> .\Untitled7.ps1
Enter the name of the Server you wish to query:
LON-DC1
LastLogon Name
--------- ----
NT AUTHORITY\SYSTEM
NT AUTHORITY\LOCAL SERVICE
NT AUTHORITY\NETWORK SERVICE
6/27/2023 9:24:25 AM ADATUM\Abbi
6/27/2023 12:10:53 PM ADATUM\Ida
6/27/2023 1:59:25 PM ADATUM\Administrator
NT AUTHORITY\SYSTEM
NT AUTHORITY\LOCAL SERVICE
NT AUTHORITY\NETWORK SERVICE
20230627092425.000000-420 ADATUM\Abbi
20230627121053.000000-420 ADATUM\Ida
20230627135925.000000-420 ADATUM\Administrator