cbs803

Accurately Get Logon Time

6 posts in this topic

#1 ·  Posted

Hi all, 

need help getting date and time from a string when a user is specified via variable which is captured from stdout but struggling to get just date and time into variable and not sure how to approach it, this is an example of the string output:

 USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
 user1                   console             2  Active       3:54  30/06/2017 02:28
 user2                                     3  Disc         3:54  03/07/2017 23:48
 

this is what i've got so far thanks to various other threads... 

#include <File.au3>
Local $cmd = 'c:\windows\sysnative\quser /server:' & @ComputerName ; don't work
Local $execute = _CMDreturn($cmd)


FileWrite("C:\Temp\TestUserLogon.txt", $execute)
MsgBox(0, "Test", $execute)

$user = "user 1"
Local $strFile = "C:\Temp\TestUserLogon.txt" ; Location of file

Func _CMDreturn($sCommand) ; This function returns the output of a DOS command as a string
    $cmdreturn = ""
    $stream = Run(@ComSpec & " /c " & $sCommand, @SystemDir, @SW_HIDE, $STDERR_MERGED + $STDIN_CHILD)
    While 1 ; loop through the return from the command until there is no more
        $line = StdoutRead($stream)
        If @error Then ExitLoop
        $cmdreturn &= $line
    WEnd
;  $cmdreturn = _OEM2ANSI($cmdreturn)
    Return $cmdreturn
EndFunc   ;==>_CMDreturn

 

written to file as maybe easier to manipulate? but if it can be done from variable that would be much better

 

Share this post


Link to post
Share on other sites



#2 ·  Posted

.. also to add gone down wmi route but cant get accurate logon time - it shows either time it last authenticated to domain or last time user authenticated from when it was at ctrl alt del screen. quser seems to be most reliable

Share this post


Link to post
Share on other sites

#4 ·  Posted

HI Danp2,

yes i did - it's giving me the same results as WMI query: Select * FROM Win32_NetworkLoginProfile and saying the user logged in yesterday yet they logged in like an hour or so ago and quser reflects that but _GetLogonTime and WMI query doesn't :-(

Share this post


Link to post
Share on other sites

#5 ·  Posted

LastLogon is usually offset by domain controllers, to get the LastLogon Time I use AD UDF function _AD_GetLastLoginDate which checks all DCs and then returns the correct last logon date for the user account.

Share this post


Link to post
Share on other sites

#6 ·  Posted

17 hours ago, Subz said:

LastLogon is usually offset by domain controllers, to get the LastLogon Time I use AD UDF function _AD_GetLastLoginDate which checks all DCs and then returns the correct last logon date for the user account.

nice one thanks will give this a go :-) 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now