Details - Sometime you need to list of users with last login time to system. It is bit difficult to get with security events/audit. This script will list all users who has logged on system and their last login time.
Catch - NTUSER.DAT file is created with every profile once user login. Script check modified date of this file and then use bubble sort to arrange it and present.
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' File - Check_User.vbs
' Author - Shankar Sahu
' Date - 09/06/2015
' Description - To Check users of local computer with last logon date/time
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
'Option Explicit
'===============================================================
'To check the OS version
'===============================================================
Dim strComputer, objWMIService, objItem,colItems, OSVersion, Shell, OSName, FPath, sysdrive
Set Shell = CreateObject("Wscript.Shell")
sysdrive = Shell.ExpandEnvironmentStrings("%SYSTEMDRIVE%")
strComputer = Shell.ExpandEnvironmentStrings("%computername%")
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_OperatingSystem",,48)
For Each objItem in colItems
OSVersion = Left(objItem.Version,3
'Case to convert number to Name
Select Case OSVersion
Case "6.2"
OSName = "Windows 8"
FPath = sysdrive+"\Users"
Case "6.1"
OSName = "Windows 7"
FPath = sysdrive+"\Users"'WScript.Echo FPath
Case "6.0"
OSName = "Windows 2008"
FPath = sysdrive+"\Users"
Case "5.2"
OSName = "Windows 2003"
FPath = sysdrive+"\Documents and Settings"
Case "5.1"
OSName = "Windows XP"
FPath = sysdrive+"\Documents and Settings"
Case "5.0"
OSName = "Windows 2000"
FPath = sysdrive+"\Documents and Settings"
Case "4.0"
OSName = "Windows NT 4.0"
FPATH = sysdrive+"\Documents and Settings"
Case Else
OSName = "Newer/Old Version"
FPath = sysdrive+"\Users"
End Select
Next
'===============================================================
'To Find the Recent Modified file in Folders and Sub Folders
'===============================================================
Dim strFolder, objFolder, objFile, dtmDate , objFSO , recentFile, ModifiedDate
Dim strLog, objLog , fc, Fusers , FSOpath , File , ModDate
Dim Day,today, indexi ,index
Dim fordisp
'Iteration Through the Sub Folders
strFolder = FPath
Set recentFile = Nothing
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFolder = objFSO.GetFolder(strFolder)
Set fc = objFolder.SubFolders
indexi = 0
For Each Fusers in fc
indexi=indexi+1
Next
Redim arr(indexi,1)
indexy = 0
For Each Fusers in fc
objFolder= FPath & "\" & Fusers.Name
'WScript.Echo ObjFolderSet
objFSO = CreateObject("Scripting.FileSystemObject")
Set FSOpath = objFSO.GetFolder(objFolder)
File = FSOpath + "\NTUSER.DAT"'
WScript.Echo " " & File
If(objFSO.FileExists(File)) then
Set objFile = objFSO.GetFile(File+"")
arr(indexy,0)=objFile.DateLastModified
arr(indexy,1)=Fusers.Name
indexy=indexy+1
End If
Next
'===============================================================
'Sorting
'===============================================================
'Sorting Multidimensional array in Descending order
Dim i , j , Temp, Temp1
For i=0 to indexi
For j=1 to indexi-1
if arr(i,0) > arr(j,0) then
Temp=arr(j,0)
Temp1=arr(j,1)
arr(j,0)=arr(i,0)
arr(j,1)=arr(i,1)
arr(i,0)=Temp
arr(i,1)=Temp1
End If
Next
Next
j=indexi
For i=0 to indexi-1
Wscript.Echo "OK: The user " & arr(i,1) &" had logged this machine at "& formatDate(arr(i,0))
' Displaying Data
j=j-1
Next
'===============================================================
'Custom Sub to check the latest file in the Folders & Sub Folders - Not Used
'===============================================================
Sub EnumFiles(ByVal objParent)
Dim objChild , recentFile
recentFile=False
For Each objFile in objParent.Files
If not recentFile Then
recentFile = False
ElseIf (objFile.DateLastModified > recentFile.DateLastModified) Then
Set recentFile = True
End If
If not recentFile Then
WScript.Echo recentFile & " " & recentFile.DateLastModified
Else
WScript.Echo recentFile & " " & recentFile.DateLastModified
End If
Next
For Each objChild in objParent.SubFolders
Call EnumFiles(objChild)
Next
End Sub
'===============================================================
'As No built function to customize Date & Time Format
'===============================================================
Public Function formatDate(sDate)
Dim String2, indexNum, sDay, sMonthYear, sMonth, sYear, sHour ,sMinute,sSec
sYear = Year(sDate)
sMonth = LPad(Month(sDate), "0", 2)
String2 = FormatDateTime(sDate, vbShortDate)
indexNum = inStr(String2, "/")
'sDay = Left(sDate, indexNum - 1)
sHour = LPad(Hour(sDate), "0", 2)
sDay = LPad(DatePart("d", sDate), "0", 2)
sMinute = LPad(Minute(sDate), "0", 2)
sSec = LPad(Second(sDate), "0", 2)
formatDate = sYear & "-" & sMonth & "-" + sDay + " " & sHour & ":" & sMinute & ":" & sSec
End Function
Function LPad (str, pad, length)
LPad = String(length - Len(str), pad) & str
End Function
No comments:
Post a Comment