Hello,
The log-on user’s information is stored in the registry. You can check them out in the following location in the RegEditor app.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI
Get-ItermProperty is a very useful PowerShell cmdlet that lets you retrieve information from your registry effectively.
$regpath = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI'
$regvalue = Get-ItemProperty -Path $regpath
$regvalue.LastLoggedOnUser
$regvalue.LastLoggedOnDisplayName
To get the information from a remote computer, wrap it up in a Invoke-Command cmdlet.
$computer = Read-Host 'Computer'
Invoke-Command -ComputerName $computer -ScriptBlock {
$regpath = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI'
$regvalue = Get-ItemProperty -Path $regpath
$regvalue.LastLoggedOnUser
$regvalue.LastLoggedOnDisplayName
}
Repeat the process if you want to get the last logged on user information from a group of computers.
Note that
in order to get the PowerShell scripts to work on remote computers, there are two prerequisites that need to be met.
Here's a good link as to what I did with the Select-Object cmdlet:
https://learn.microsoft.com/en-us/previous-versions/technet-magazine/hh750381(v=msdn.10)?redirectedfrom=MSDN
WinRM needs to be enabled on the remote computer
You need proper credentials to run the script on the remote computer.
I hope this will help you further.
Regards,