Enumerating Log On & Log Off Activities

PowerView

Get username, last logged on, last log off of all users in current domain

Get-NetUser | Select samaccountname,lastlogon,lastlogoff

Get username, last logged on, last log off of a specific user in current domain

Get-NetUser -UserName <USERNAME> | Select samaccountname,lastlogon,lastlogoff

Get username, last logged on, last log off of all users in another domain

Get-NetUser -Domain <DOMAIN NAME> | Select samaccountname,lastlogon,lastlogoff

Get username, last logged on, last log off of a specific user in another domain

Get-NetUser -UserName <USERNAME> -Domain <DOMAIN NAME> | Select samaccountname,lastlogon,lastlogoff

Get "Last Logoff" property for all users in current domain

Get-UserProperty -Properties lastlogoff

Get "Last Logon" property for all users in current domain

Get-UserProperty -Properties lastlogon

Get "Last Logoff" property for all users in another domain

Get-UserProperty -Properties lastlogoff -Domain <DOMAIN NAME>

Get "Last Logon" property for all users in another domain

Get-UserProperty -Properties lastlogon -Domain <DOMAIN NAME>

Get actively logged users on a computer (needs Local Admin rights on target)

Get-NetLoggedon -ComputerName <SERVER NAME>

Get locally logged users on a computer (needs Remote Registry on target - started by default on Server OS)

Get-LoggedonLocal -ComputerName <SERVER NAME>

Get last logged user on a computer (need Local Admin right & Remote Registry on target)

Get-LastLoggedon -ComputerName <SERVER NAME>

Sort the last logged on time for all users in current domain

Get-NetUser | select samaccountname, lastlogon, pwdlastset | Sort-Object -Property lastlogon

Sort the last logged on time for all users on another domain

Get-NetUser -Domain <DOMAIN NAME> | select samaccountname, lastlogon, pwdlastset | Sort-Object -Property lastlogon