Hi, for project I’m working on I need to know for every Windows Workstation the users that might have logged on to the device and last time they have logged on, these can be local/AD Users.
Below relevance provides me with that information
(sid (string value of property “sid” of it) as string | string value of property “sid” of it, (format “{0}-{1}-{2} {3}:{4}:{5}” + year of item 1 of it as string + month of item 1 of it as two digits as string + day_of_month of item 1 of it as two digits as string + two digit hour of item 0 of it + two digit minute of item 0 of it + two digit second of item 0 of it) of (time (universal time zone) of it, date (universal time zone) of it) of (time value of property “LastUseTime” of it) as string) of (select objects “sid,LastUseTime from Win32_UserProfile” of wmi) whose (set of (“S-1-5-20”;“S-1-5-19”;“S-1-5-18”) does not contain string value of property “sid” of it)
Output is something like below
A: S-1-5-21-625710931-4099100787-3483471831-1001, 2023-01-26 08:37:07 → Local Account
A: NA\xxxxxxx, 2023-01-24 08:56:22 → AD Accounts
A: NA\yyyyyyy, 2023-01-24 08:56:22 → AD Accounts
Issue I have is that for local account it returns the SID vs. name of local account. I know that the info is available in following registry location
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList (ProfileImagePath) I can get the username.
I can get the info with below relevance
value “ProfileImagePath” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-625710931-4099100787-3483471831-1001” of native registry
Would it be possible to have updated relevance that would return me the local user name vs. SID and ideally in same relevance statement, I’ve tried playing around with if-then-else but not having much luck.
Any other suggestions to get this info are welcome
Thx.