Active Directory User Logon Time Log Çekme Hk.

Merhaba, 

Lepide audit ile logları inceleyebilirsiniz.

https://www.lepide.com/blog/audit-successful-logon-logoff-and-failed-logons-in-activedirectory/

Bunu bat olarak yazip, user gpo dan startup koy

set share=\\server\log\logoninfo.csv

for /f "Tokens=2 Delims=[]" %%i in ('ping -n 1 "%computername%"') do set IP=%%i
set qry=where "ipenabled=true"
set params=description^^,ipaddress^^,macaddress^^,MTU
for /f "usebackq skip=2 tokens=1-4 delims=," %%a in (
  `wmic nicconfig %qry% get %params% /format:csv ^<nul^|find /v "0.0.0.0"`
    ) do set MAC=%%d

@echo %Date%, %TIME%, %username%, %computername%, %IP%, %MAC%  >>%share%

selam

bunu kullanabilirsin

$Path = 'C:\Temp\LastLogon.csv'
Get-ADUser -Filter {enabled -eq $true} -Properties LastLogonTimeStamp |

Select-Object Name,@{Name="Stamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp).ToString('yyyy-MM-dd_hh:mm:ss')}} | Export-Csv -Path $Path –notypeinformation