Get a list of who logged in to each server

I am looking for a way to query Active Directory or SMS or something so I can get a list of users who have logged into a Windows server for several servers. It would be like checking the lastlog file on Linux. I don't need the time or anything else except the user name.

Something with an output as simple as: SERVERNAME: shatnerw, nimoyl, kelleyd,

Any input on this would be great. Even if it's "use this function in VB script".

Thanks, ablackhat

Edit: So far I have found the info is in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. It has the guid which is fine. Now I need to figure out a way to query that remotely.


If you just want the profile list, PowerShell is probably your best bet.

$Server = 'RemoteServer'
$Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $Server)

This will instantiate $reg as a holder for the remote registry object in HKLM. To get at the bit you want:

$ProfileList = $Reg.OpenSubKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList')

This will populate $ProfileList with the subkeys for the profiles themselves. Then to extract the list of users:

Write-Host "`n$Server: " -nonewline
ForEach ($SID in $ProfileList.GetValueNames()) {
    $ProfileKey = $ProfileList.OpenSubKey($SID)
    # Get the ProfileImagePath key
    $ProfileKey.GetValue("ProfileImagePath")
    # Break the path up into an array, using \ as the delimiter
    $PathBits = $ProfileKey.Split("\")
    # The last element of the array is our user, find the last element
    $LastIndex = $PathBits.Count - 1
    # Dump the last element to something useful
    $User = $PathBits[$LastIndex]
    # Output the user
    write-host " $User" -nonewline
}

Or something close to that. It's off the top of my head.