-
Notifications
You must be signed in to change notification settings - Fork 3
/
Get-MostLogins.ps1
119 lines (92 loc) · 3.33 KB
/
Get-MostLogins.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
function Get-MostLogins {
<#
.SYNOPSIS
Finds all domain machines a user has logged into by using the users 'real' name
.DESCRIPTION
This script uses my user login script log and finds
what machine the user logs into most. In my environment users log into several machines, this makes finding their primary
machine much easier. I will use this script in subsequent scripts to auto find the users primary machine and preform an
action.
I've added the ablity to choose either a file that contains a list of users to find most logins or one user
I've also added a fix for users with apostrophe's in their name
.PARAMETER Name
Searches a single user by their 'real' name
.PARAMETER File
Takes a text file with a list of users 'real' names and queries them with this script. You must specify full path to file
.PARAMETER Full
Lists all the machines a user has logged into
.EXAMPLE
Get-MostLogins -Name "Joe Rodriguez"
This command will show what machine Joe Rodriguez logged into the most
.EXAMPLE
Get-MostLogins -File c:\users\joerod\desktop\users.txt
This command will show what machine all the users in the text file users.txt logged into the most
.EXAMPLE
Get-MostLogins -Name "Joe Rodriguez" -Full
This command will show all machines Joe Rodriguez logged into
#>
[CmdletBinding(DefaultParameterSetName="Name")]
param(
[Parameter(Position=0, ParameterSetName="File")]
[string]
$File,
[Parameter(Position=0, ParameterSetName="Name")]
[string]
$Name,
[switch]$Full
)
if ($psCmdlet.ParameterSetName -eq "File") {
foreach($name in gc $file){
#if name has an apostrophe
if($name.Contains("'")){
$name = ($name.replace("'","''"))
}
try{
foreach($user in (Get-ADUser -Properties * -Filter "Name -like '$Name*'" -ErrorAction Stop | ? {$_.Enabled -contains "True"})){
$array = Import-Csv \\Path\to\Share\Logon.log | ? {$_.username -eq $user.samaccountname} | % {
New-Object -TypeName PSCustomObject -Property @{
Name = $user.name
SAMAccoutName = $user.samaccountname
ComputerName = $_.computername
}
}
if($full){
$array
}
else{
$array | sort | group ComputerName | sort Count | select -ExpandProperty Group | select -last 1
}
}
}
catch{
Write-Warning "Cannot find $name"
}
}
}
else {
#if name has an apostrophe
if($name.Contains("'")){
$name = ($name.replace("'","''"))
}
try{
foreach($user in (Get-ADUser -Properties * -Filter "Name -like '$Name*'" | ? {$_.Enabled -contains "True"})){
$array = Import-Csv \\Path\to\Share\Logon.log | ? {$_.username -eq $user.samaccountname} | % {
New-Object -TypeName PSCustomObject -Property @{
Name = $user.name
SAMAccoutName = $user.samaccountname
ComputerName = $_.computername
}
}
if($full){
$array
}
else{
$array | sort | group ComputerName | sort Count | select -ExpandProperty Group | select -last 1
}
}
}
catch{
Write-Warning "Cannot find $name"
}
}
}