0

I am trying to query instead of visiting every computers' User folder manually on Windows 7 and 10. I need to generate a list for roughly 85 computers including the users who have ever logged into it. CCM doesn't seem to have anything specifically good for this but local admin. I know I can run powershell to get currently logged in user(s) but I need all users who have ever logged in. Is there a way to get all users who have logged in from a computer via powershell or other method so I don't have to manually check them all for efficiency reasons

Acurze
  • 67
  • 8

2 Answers2

1

Everyone who logs on gets a profile created, so you could inspect all the existing profiles, which will appear as directories under C:\Users. Assuming you have admin rights on the remote machine, you can do this:

Get-ChildItem -Path "\\computername\c$\Users" | Select Name

You will have to filter out some entries, like Default.

That will give you the usernames. But if you have more than one domain in your environment, that might not be enough, since it won't tell you which domain the accounts are from. If that's an issue for you, you could look at the registry. There is a list of profiles at:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

That has the SID of each account, which you can then look up in AD to find the account. There is an example of looking at the registry in PowerShell here: https://stackoverflow.com/a/15069578/1202807

Gabriel Luci
  • 38,328
  • 4
  • 55
  • 84
0
$Users = Get-Content -Path "C:\PCs.txt"
$out = ForEach ($user in $users)
{ invoke-command -computername $User {Get-ChildItem "C:\users" |
select-object Name, @{Name='ComputerName';Expression={ $env:COMPUTERNAME }} |
ft -AutoSize
}}

$out | Out-File "c:\users.txt"

This Powershell command worked for Windows 10, without a filter though.

Acurze
  • 67
  • 8