Use PowerShell to get last logon information

• Author
• Recent Posts

Michael Pietroforte

Michael Pietroforte is the founder and editor in chief of 4sysops. He has more than 35 years of experience in IT management and system administration.

Latest posts by Michael Pietroforte (see all)

• Poll: How reliable are ChatGPT and Bing Chat? - Tue, May 23 2023
• Pip install Boto3 - Thu, Mar 24 2022
• Install Boto3 (AWS SDK for Python) in Visual Studio Code (VS Code) on Windows - Wed, Feb 23 2022

In a previous post, I explained how you can enable interactive logon logging in Active Directory. Today, I’ll show you how to use PowerShell to retrieve the information from the corresponding Active Directory attributes.

If you want to try the examples in this article on your desktop, you’ll have to install the Active Directory module for Windows PowerShell. This module is already available on every domain controller in an Active Directory domain with a functional level of Windows Server 2008 R2 or higher.

Note that I will only discuss the last interactive logon attributes in this article. However, you can also use the examples in this post for the lastLogon and lastLogontimeStamp attributes, which are useful for listing inactive accounts if you replace the attributes in the commands accordingly.

As discussed in my previous article, you can use the interactive logon attributes for gathering real-time information about the last successful (msDS-LastSuccessfulInteractiveLogonTime) and unsuccessful (msDS-LastFailedInteractiveLogonTime) user logon times. In addition, you can retrieve the number of failed logons (msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon) of a user account since the last successful logon, as well as the failed logons since the feature was enabled (msDS-FailedInteractiveLogonCount).

Note: After I finished this post, I noticed that the msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon attribute does not store the correct value. Even though the information is correctly displayed on the logon screen, msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon always has the same value as msDS-FailedInteractiveLogonCount. This appears to be a bug in Windows Server 2012 R2. It is not a PowerShell issue because I also see the wrong values in ADUC. Please let me know if you get the same results in your tests.

The cmdlet we need to gather the information is Get-ADUser, which enables you to query information about Active Directory user objects. The easiest case would be if you want to know the number of failed logons since the last successful logon for a particular user. For example:

Get-ADUser -Filter {Name -eq "Administrator"} -Properties * | Select-Object Name, msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon

You can use the Filter parameter to search for user objects that have a certain attribute value. In the example, we restrict the output to the Administrator account. The Properties parameter is required because the interactive logon attributes are not included in the default set of properties (attributes) that the Get-ADUser cmdlet retrieves. By using the asterisk, we display all of the attributes that are set on the user object. We then pipe the output to the Select-Object cmdlet, which restricts the output to the name of the user account and the number of failed logons at the last successful logon.

If you want to find out what account logout threshold you should configure in your network, you could create a list that is sorted according to the number of failed logons at the last successful logon:

Get-ADUser -Filter * -Properties * | Select-Object Name, msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon | Sort-Object -Descending msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon

If you run the above command every day for a week or so, you will get a feeling for how often users mistype their passwords.

Or perhaps you just want to know how many of your users would fall prey to your account logout threshold. The command below counts the number of users who mistyped their password more than three times since the last successful logon:

Get-ADUser -Filter * -Properties * | Where-Object msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon -gt 3 | Measure-Object | Select-Object Count

Things get a bit trickier if you want to know the time of the last failed logon. The problem is that the attribute stores this information in the Windows file time format, a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601. If you don’t happen to be Rain Man, you have to let the computer convert the value into a human-readable format. For this, we use the .NET method DateTime.FromFileTime, which converts the Windows file time to an equivalent local time. This is how you could display the last failed interactive logon time for the Administrator account:

Get-ADUser -Filter {Name -eq "Administrator"} -Properties * | Select-Object Name, @{Name="Last failed logon time";Expression={[datetime]::FromFileTime($_.'msDS-LastFailedInteractiveLogonTime')}}

The @{} syntax creates a hash table, which is just a collection of key-value pairs. In our case, we have two pairs: the Name key, which has the value “Last failed logon time,” and the Expression key, for which we calculate the value with the above-mentioned .NET method. “$_” stands for the user object that we pipe to the Select-Object cmdlet. We use this hash table as a calculated property that allows us to select the property and convert it into a human-readable format.

If you suspect that someone is trying to hack accounts in your network by guessing passwords, you might want to create a list of all user accounts with all four interactive logon attributes. If you notice that some accounts have unusually high numbers of failed logons since you activated the feature, but those accounts were never locked, someone might be aware of your password account threshold and patiently tries just a few passwords every day. Of course, another explanation would be that your users really need new keyboards. 😉

Get-ADUser -Filter * -Properties * | Select-Object -Property Name, @{Name="Total failed logons";Expression="msDS-FailedInteractiveLogonCount"}, @{Name="Recent failed logons";Expression="msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon"}, @{"Name"="Last failed logon";Expression={[datetime]::FromFileTime($_.'msDS-LastFailedInteractiveLogonTime')}}, @{"Name"="Last successful logon";Expression={[datetime]::FromFileTime($_.'msDS-LastSuccessfulInteractiveLogonTime')}} | Sort-Object Name | Format-Table

If you see “31/12/1600” as a date, it doesn’t mean that one of your users possesses a time machine. This user just never logged in interactively.

Another piece of interesting information could be the time difference between the last successful logon and the last unsuccessful one.

foreach ($User in Get-ADUser -Filter * -Properties *)
{   
    $TimeSpan = "{0:dd\:hh\:mm\:ss}" -f ([timespan]::fromticks($User.'msDS-LastSuccessfulInteractiveLogonTime' - $User.'msDS-LastFailedInteractiveLogonTime'))
    $LastFailedLogon= [datetime]::FromFileTime($User.'msDS-LastFailedInteractiveLogonTime')
    $LastSuccessfulLogon= [datetime]::FromFileTime($User.'msDS-LastSuccessfulInteractiveLogonTime')   
    @{"User" = $User.Name; "Last failed logon" = $LastFailedLogon; "Last successfull logon" = $LastSuccessfulLogon; "Time span" = $TimeSpan }.GetEnumerator() | Sort -Descending -Property Name | Format-Table
}

The first line calculates the time difference using a .NET function and then formats the value in human-readable format (days, hours, minutes, seconds). In the last line, we again use a hash table to display the result. We need the GetEnumerator() method so we can sort our hash table.

Please let me know if you could confirm the bug regarding the failed logon counts I mentioned above.