Generate a list of last user logon times for a domain

Save the following script like usrlogin.vbs

—8<—
On Error Resume Next
Set oDomain = GetObject(”WinNT://” & WScript.Arguments(0))
oDomain.Filter = Array(”User”)
WScript.Echo “Showing last login times of accounts from: ” & oDomain.Name & vbCRLF
For Each oDItem In oDomain
Err.Clear
sULogin = oDItem.LastLogin
For nI = 1 To (WScript.Arguments.Count - 1)
Set oUsr = GetObject(”WinNT://” & WScript.Arguments(nI) & “/” & oDItem.Name & “,user”)
If oUsr.LastLogin > sULogin Then sULogin = oUsr.LastLogin
Next
If Err.Number = 0 Then WScript.Echo “Username: ” & Left(oDItem.Name & Space(22),22) & “Last login: ” & FormatDateTime(sULogin)
Next
—8<—

and execute it from the command line like

—8<—
C:\>cscript d:\temp\usrlogin.vbs //nologo PDC BDC1 BDC2
Showing last login times of accounts from: PDC

Username: dummyno1 Last login: 2001-03-17 13:59:10
Username: dummyno2 Last login: 2001-03-06 14:57:39
Username: dummyno3 Last login: 2001-03-24 15:26:32
Username: dummyno4 Last login: 2001-03-26 15:26:32
Username: dummyno5 Last login: 2001-03-17 08:21:51
Username: dummyno6 Last login: 2001-03-15 15:06:18
Username: dummyno7 Last login: 2001-03-27 15:46:10
Username: dummyno8 Last login: 2001-03-13 15:49:42
Username: dummyno9 Last login: 2001-03-26 10:18:54
—8<—

Change “PDC BDC1 BDC2″ with a list of the names of your DCs, starting with the PDC. If the first argument isn’t the PDC (or domain) name, some accounts may be left out of the list. Only accounts which have been logged in to at least once will be shown.