Hi guys,
Help if possible!
Essentially I’m trying to figure out how to display an analysis that will show all computers that have not logged in (domain user) for X amount of days (30 or 90 for example).
Or just show all computers with the date of their last logon.
Essentially trying to find through a few thousand PC’s if some aren’t being used, and last logon X date might be the best method.
Not sure how to go about this.
Thanks,
Rob.
This might be helpful:
Sortable Last Logon DATE, TIME, USER
https://bigfix.me/relevance/details/3018939
((year of it as string & " " & month of it as two digits & " " & day_of_month of it as two digits) of date ("ut" as time zone) of it as string) of (unique value of items 0 of (modification time of it,name of parent folder of it) whose (item 0 of it = (maximum of modification times of files "NTUSER.DAT" of folders whose (exists file "NTUSER.DAT" of it AND name of it as lowercase is not contained by set of ("networkservice";"localservice";"administrator";"default";"public";"OTHER_EXCLUDED_USERS")) of (folders "c:\users"; folders "c:\Documents and Settings"))) of files "NTUSER.DAT" of folders whose (exists file "NTUSER.DAT" of it AND name of it as lowercase is not contained by set of ("networkservice";"localservice";"administrator";"default";"public";"OTHER_EXCLUDED_USERS")) of (folders "c:\users"; folders "c:\Documents and Settings")) & ", " & substring (17,8) of it of (unique value of items 0 of (modification time of it,name of parent folder of it) whose (item 0 of it = (maximum of modification times of files "NTUSER.DAT" of folders whose (exists file "NTUSER.DAT" of it AND name of it as lowercase is not contained by set of ("networkservice";"localservice";"administrator";"default";"public";"OTHER_EXCLUDED_USERS")) of (folders "c:\users"; folders "c:\Documents and Settings"))) of files "NTUSER.DAT" of folders whose (exists file "NTUSER.DAT" of it AND name of it as lowercase is not contained by set of ("networkservice";"localservice";"administrator";"default";"public";"OTHER_EXCLUDED_USERS")) of (folders "c:\users"; folders "c:\Documents and Settings") as string) & ", " & (unique value of items 1 of (modification time of it,name of parent folder of it) whose (item 0 of it = (maximum of modification times of files "NTUSER.DAT" of folders whose (exists file "NTUSER.DAT" of it AND name of it as lowercase is not contained by set of ("networkservice";"localservice";"administrator";"default";"public";"OTHER_EXCLUDED_USERS")) of (folders "c:\users"; folders "c:\Documents and Settings"))) of files "NTUSER.DAT" of folders whose (exists file "NTUSER.DAT" of it AND name of it as lowercase is not contained by set of ("networkservice";"localservice";"administrator";"default";"public";"OTHER_EXCLUDED_USERS")) of (folders "c:\users"; folders "c:\Documents and Settings") as string)
If you’re just trying to get a list of applicable computers, creating a fixlet is probably more useful. You could try relevance like this which should match the last logon timestamp the NET USER command reports:
not exists logged on users AND not exists users whose (last logon of it > (now - 30*day))