正在检查在一台计算机或计算机列表上最后登录的用户/samaccountname

Question

如果我有来自AD的电脑名称，我能以某种方式检查哪个用户/samaccountname最后一次登录到电脑列表上吗？

我试过了：

$TargetName = “W7XXXXXXXXXX”
$RC = Get-WinEvent -Computer 
$TargetName -FilterHashtable @{ Logname = ‘Security’; ID = 4672 } -MaxEvents 1 | Select @{ N = ‘User’; E = { $_.Properties[1].Value } }, TimeCreated$RC.Username$RC.TimeCreated

错误是意外的令牌-FilterHashtable

Answer 1

这需要在一行上：

$RC = Get-WinEvent -ComputerName $TargetName -FilterHashtable @{ Logname = ‘Security’; ID = 4672 } -MaxEvents 1 | Select @{ N = ‘User’; E = { $_.Properties[1].Value } }, TimeCreated$RC.Username$RC.TimeCreated

或添加"`">

$TargetName = "sql01"
$RC = Get-WinEvent -ComputerName `
$TargetName -FilterHashtable @{ Logname = ‘Security’; ID = 4672 } -MaxEvents 1 | Select @{ N = ‘User’; E = { $_.Properties[1].Value } }, TimeCreated$RC.Username$RC.TimeCreated