pirmdiena, 2013. gada 4. marts

Enumerate windows local users and last logon time vbs

This script shows active as well inactive local windows users. Strange but I did not found this in internet so I had to make myself combining two scripts. So what it does, take property LastLogon for each user and writes in file LastLogon.txt  PowerShell did not show any wmi property LastLogon for local Users. Script works fine on Windows Server 2008, not intended for domain users. You just need to create file LastLogon.txt in the same directory as vbs script and run it from Administrator command prompt. So it appears in the same directory as vbs script. Just save the code with extension vbs and it works great. Thanks to Roger Ling 


Option Explicit

Dim objWMIService, colItems, WshNetwork, strComputer
Dim objUser, objItem, dtmLastLogin, strLogonInfo
Dim filesys, filetxt, Writetxt
Const ForReading = 1, ForWriting = 2, ForAppending = 8 
Set WshNetwork = CreateObject("Wscript.Network")
Set filesys = CreateObject("Scripting.FileSystemObject")
Set filetxt = filesys.OpenTextFile("LastLogon.txt", ForAppending, True)
strComputer = WshNetwork.ComputerName
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery( _
"Select * from Win32_UserAccount Where Domain = '" & strComputer & "'")
Writetxt = ""
For Each objItem in colItems 
dtmLastLogin = ""         
On Error Resume Next 
Set objUser = GetObject("WinNT://" & strComputer _     
& "/" & objItem.Name & ",user") 
dtmLastLogin = objUser.lastLogin 
On Error Goto 0
strLogonInfo = strLogonInfo & vbCrLf & objItem.Name & ": " & dtmLastLogin
      Next 
 Writetxt=Writetxt & strLogonInfo 
 filetxt.WriteLine(Writetxt)
 filetxt.Close
***
After that I had to modify script, boss wanted to know, which users are disabled so after objItem.Name you can add any object like objItem.Dsiabled so after perturbations my string looks like this
strLogonInfo = strLogonInfo & vbCrLf & objItem.Name & " Time " & dtmLastLogin & " Disabled " & objItem.Disabled
Notice empty spaces, it is for export to excel. Possible Items can be found here  I discovered other computer was mapped via CredentiialManager so they was not actually active, but it shows anyway realy inactive users.

Nav komentāru:

Ierakstīt komentāru