I am looking for a way to query Active Directory or SMS or something so I can get a list of users who have logged into a Windows server for several servers. It would be like checking the lastlog file on Linux. I don't need the time or anything else except the user name.
Something with an output as simple as: SERVERNAME: shatnerw, nimoyl, kelleyd,
Any input on this would be great. Even if it's "use this function in VB script".
Thanks,
ablackhat
Edit: So far I have found the info is in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. It has the guid which is fine. Now I need to figure out a way to query that remotely.
Best Answer
If you just want the profile list, PowerShell is probably your best bet.
This will instantiate $reg as a holder for the remote registry object in HKLM. To get at the bit you want:
This will populate $ProfileList with the subkeys for the profiles themselves. Then to extract the list of users:
Or something close to that. It's off the top of my head.