Get-ADGroup Members with their most recent Lastlogon

kayal24 · 2021-10-15T18:53:27.000Z

Hello, I would like to get a report of ad group members with their last logon from the most recent domain controller. Here what i have so far but something im doing wrong… any help will be appreciate.

$ADGROUP = Read-Host 'Please enter the GROUP NAME'

$data = @()
$DCs = Get-ADDomainController -Filter * | Select-Object -ExpandProperty name 
$Users = Get-ADGroupMember -Identity $ADGROUP | ? {$_.objectclass -eq "user"}

foreach ($DC in $DCs) {
foreach ($User in $Users) 
{$data += Get-ADUser -Identity $User -Properties displayname, userprincipalname, samaccountname, title, department, lastlogon -server $DC | Select-Object displayname, userprincipalname, samaccountname, title, department, lastlogon
}
} 

$data | Group-Object UserPrincipalName | Foreach-Object {$_.Group | Sort-Object lastLogon | Select-Object -Last 1 | export-csv "C:\Temp\$ADGroup ($(Get-Date -Format "yyyy-MM-dd")).csv" -append -NoTypeInformation -Delimiter ';' -Encoding UTF8}

Write-Host Done!

Neally · 2021-10-15T18:59:54.000Z

Ak2595:

something im doing wrong.

can you elaborate?

How many DCs do you have?

I have a bunch, I found it to be faster to FIRST pull the data and then compare it against them.

Neally · 2021-10-15T19:05:20.000Z

Get-ADGroupMember is limited with how many members it can return.

Also you did not specify ‘-recursive’ so maybe users are missing?

I’m frustrated by your posts as they are always lacking details.

Help us help you and provide details.

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

Neally · 2021-10-15T21:22:40.000Z

maybe try like so

$ADGROUP = 
Read-Host 'Please enter the GROUP NAME'

$DCs = 
(Get-ADDomainController -Filter *).name

$Users = 
try{
    Get-ADGroupMember -Identity $ADGROUP -Recursive -ErrorAction Stop | 
    where-object { $_.objectclass -eq "user" }
}
catch{
    throw $Error[0].exception.Message
}

$step = 1

$DCReport = 
foreach ($User in $Users) {
    $DCData = 
    foreach($DC in $DCs){

        $progress = @{
            ID               = 1
            Activity         = "Progress" 
            Status           = "$([math]::Round((($step / $($users|measure-object).count * 100)),0))% Complete"
            PercentComplete  = (($step / $($users|measure-object).count) * 100)
            CurrentOperation = "Getting data from DC '$dc' for user '$user'"
        }
        Write-Progress @progress

        Get-ADUser -Identity $User -Properties displayname, userprincipalname, samaccountname, title, department, lastlogon -server $DC | 
        Select-Object displayname, userprincipalname, samaccountname, title, department, lastlogon,@{n='LLO';e={[datetime]::FromFileTime($_.lastlogon)}}

        $step++
    }
    $DCData | 
    Sort-Object LLO  | 
    Select-Object -Last 1

}

$DCReport |
export-csv "C:\Temp\$ADGroup_$(Get-Date -Format "yyyy-MM-dd").csv" -NoTypeInformation -Delimiter ';' -Encoding UTF8