Setup: A Windows server member of a domain or workgroup

Problem: You need LastLogon date for all the users who ever logged in on that server.

Solution: Open PowerShell console and run this script:

$data = @() 

$NetLogs = Get-WmiObject Win32_NetworkLoginProfile -ComputerName ".";
foreach ($NetLog in $NetLogs) { 
if ($NetLog.LastLogon -match "(\d{14})") { 
$row = "" | Select Name,LogonTime 
$row.Name = $NetLog.Name 
$row.LogonTime=[datetime]::ParseExact($matches[0], "yyyyMMddHHmmss", $null) 
$data += $row 


  1. Brandy Olsen

    If the LastLogon property is blank does that mean that particular profile has never logged in to the machine? Why would the profile even be in the Win32_NetworkLoginProfile though if that is the case? I’m seeing a ton of admin user accounts that have no value in the LastLogon property on the servers. I am trying to understand what this means.

Leave a Reply

Your email address will not be published. Required fields are marked *