Direct Inward Dialing: +1 408 916 9892
Administrators would often want to know the list of all users who currently logged in. This information can be got by using Windows Poweshell scripts. However, writing the script and changing it everytime to generate the report in specified format is a tedious process. AD auditing solution like ADAudit Plus can help administrators get this report in a jiffy. The following is a comparison between obtaining all AD users' logged on report with Windows PowerShell and ADAudit Plus:
function Get-Execute it in Windows PowerShell.UserLogon { [CmdletBinding()] param ( [Parameter ()] [String]$Computer, [Parameter ()] [String]$OU, [Parameter ()] [Switch]$All ) $ErrorActionPreference="SilentlyContinue" $result=@() If ($Computer) { Invoke-Command -ComputerName $Computer -ScriptBlock {quser} | Select-Object -Skip 1 | Foreach-Object { $b=$_.trim() -replace '\s+',' ' -replace '>','' -split '\s' If ($b[2] -like 'Disc*') { $array= ([ordered]@{ 'User' = $b[0] 'Computer' = $Computer 'Date' = $b[4] 'Time' = $b[5..6] -join ' ' }) $result+=New-Object -TypeName PSCustomObject -Property $array } else { $array= ([ordered]@{ 'User' = $b[0] 'Computer' = $Computer 'Date' = $b[5] 'Time' = $b[6..7] -join ' ' }) $result+=New-Object -TypeName PSCustomObject -Property $array } } } If ($OU) { $comp=Get-ADComputer -Filter * -SearchBase "$OU" -Properties operatingsystem $count=$comp.count If ($count -gt 20) { Write-Warning "Search $count computers. This may take some time ... About 4 seconds for each computer" } foreach ($u in $comp) { Invoke-Command -ComputerName $u.Name -ScriptBlock {quser} | Select-Object -Skip 1 | ForEach-Object { $a=$_.trim() -replace '\s+',' ' -replace '>','' -split '\s' If ($a[2] -like '*Disc*') { $array= ([ordered]@{ 'User' = $a[0] 'Computer' = $u.Name 'Date' = $a[4] 'Time' = $a[5..6] -join ' ' }) $result+=New-Object -TypeName PSCustomObject -Property $array } else { $array= ([ordered]@{ 'User' = $a[0] 'Computer' = $u.Name 'Date' = $a[5] 'Time' = $a[6..7] -join ' ' }) $result+=New-Object -TypeName PSCustomObject -Property $array } } } } If ($All) { $comp=Get-ADComputer -Filter * -Properties operatingsystem $count=$comp.count If ($count -gt 20) { Write-Warning "Search $count computers. This may take some time ... About 4 seconds for each computer ..." } foreach ($u in $comp) { Invoke-Command -ComputerName $u.Name -ScriptBlock {quser} | Select-Object -Skip 1 | ForEach-Object { $a=$_.trim() -replace '\s+',' ' -replace '>','' -split '\s' If ($a[2] -like '*Disc*') { $array= ([ordered]@{ 'User' = $a[0] 'Computer' = $u.Name 'Date' = $a[4] 'Time' = $a[5..6] -join ' ' }) $result+=New-Object -TypeName PSCustomObject -Property $array } else { $array= ([ordered]@{ 'User' = $a[0] 'Computer' = $u.Name 'Date' = $a[5] 'Time' = $a[6..7] -join ' ' }) $result+=New-Object -TypeName PSCustomObject -Property $array } } } } Write-Output $result }
Following are the limitations to obtain a report of all AD users logged on using native tools like Windows PowerShell:
ADAudit Plus will generate the report by automatically scanning all DCs in the domain to retrieve the users that are logged on, displayed on a simple and intuitively designed UI.
Logon-Logoff
Account lockouts
Windows event logs
File server auditing
Active Directory auditing
Azure AD
Server auditing
Computer start-ups and shut-downs