Easy way to view last log on time for NT accounts

-
Found this great VB script over at WindowsITPro by John Savill while looking for a way to audit (and disable) accounts used for FTP access on our web server (which haven't been used in n days). If you leave the " Set oDomain = " alone and don't put in a DC, and put in the name of the local server (not the DC in " sEnterDCs = "", it will poll the local SAM database, instead of the default behaviour of going out to a DC.
' List last logon times
' 2001-03-27 John Savill, Jakob Hussfelt http://www.ntfaq.com
On Error Resume Next
sEnterDCs = "SAVILLTECH,SAVILLNT02"
sObjects = Split(sEnterDCs, ",")
Set oDomain = GetObject("WinNT://" & sObjects(0))
oDomain.Filter = Array("User")
WScript.Echo "Showing last login times of accounts from: " & oDomain.Name & vbNewLine
For Each oDomainItem In oDomain
sUsrLogin = oDomainItem.LastLogin
If UBound(sObjects) >= 1 Then
For ii = 1 To UBound(sObjects)
Set oUsr = GetObject("WinNT://" & sObjects(ii) & "/" & oDomainItem.Name & ",user")
If oUsr.LastLogin > sUsrLogin Then sUsrLogin = oUsr.LastLogin
Next
End If
WScript.Echo "Username: " & Left(oDomainItem.Name & Space(22),22) & "Last login: " & FormatDateTime(sUsrLogin)
Next
Awesome stuff.

Link

Popular posts from this blog

first bugger

-
As soon as ewido started it's scan, it found a couple of threats. And after cleaning those threats, MS Anti-Spyware Beta found, cleaned, and repeatedly does the same for something called "startup.nameshifter.og". Keeps. Finding. It. Every. Minute. Sucks. Google currently has one hit for this on a Japanese site. I can actually speak a tiny bit of Japanese, but can't read it. Translation sites are only so-so. Anyhoo, it appears that the Ewido anti-malware is a decent tool. While the demo for Webroot Spy Sweeper found a variety of objects, it won't remove anything without a subscription. Good for them; wankers. Remember the crazy chick with the buzz haircut with the infomercials a decade ago, always screaming "Stop the Insanity!"? She should be doing ads to sell anti-malware apps.
Read more

Make Firefox Look Like Internet Explorer

-
I know, I know, why would you do this? What can I say...I like the way I can customize IE. But after getting hit with this stupid WMF vulnerability (the popups are back, by the way, the box is hosed), IE is dead to me. When running at higher resolutions (XGA & up), it's great to be able to combine toolbars. In IE, you can drag and drop toolbars onto the same level. Turns out in Firefox, you can customize & put all the objects onto one or two toolbars . Beautiful. You can even get a skin to make Firefox look like IE. I know, I know. But it's all about comfort level. And not getting infected with the next zero-freaking-day-freaking-exploit. Besides, if you can make Firefox look like IE, then make it the default browser for you end-users....most of them won't know or won't care. There are some exceptions (Exchange 2003's Outlook Web Access is positively beautiful in IE). I'm more/less talking about day-to-day usage.
Read more

Windows XP Activation and P2V

-
At the office, I'm gradually converting a ton of legacy PC's to virtual machines. The quick & easy way is to run ntbackup on the old box, bring up a vanilla virtual machine, and restore it onto that. NTbackup is also great when, months from now, someone says oops..I need n . The P2V assisitant, and VMWare's Knoppix distro , is also incredibly good. Sometimes, however, even when the P2V process is flawless, Windows still wants to sh!t a bit. Twice now, I've converted Dell laptops to virtual machines, and had Windows Product Activation rear it's ugly head. we have a volume licensing agreement, but for some ungodly reason, these machines were deployed (before I was here) with the image that came from Dell. With all the crapware that they include. And low and behold, following the ntbackup restore and reboot, Windows XP wants you to reactivate. No thanks. I boot from the Ultimate P2V ISO, just because I love it, and you can customize it with a ton of great t...
Read more