I have this code that works.
$machine = (Get-ADComputer -Filter * -SearchBase "ou=acme_workstations,dc=acme,dc=org").Name
$objs = foreach ($pc in $machine)
{Get-ADComputer $pc -Properties LastLogonDate | select name, LastLogonDate} $objs | Export-Csv -NoTypeInformation -Path "C:\temp\LastReboot.csv"
I read this about LastLogonDate: Powershell was nice enough to give us a third option to query by. LastLogonDate is a converted version of LastLogontimestamp. He was technically right. It’s not a replicated attribute. Instead, it’s a locally calculated value of the replicated value. Most importantly, it gives us the ability to query using human friendly date formats!! (taken from this web page: http://social.technet.microsoft.com/wiki/contents/articles/22461.understanding-the-ad-account-attributes-lastlogon-lastlogontimestamp-and-lastlogondate.aspx)
So I looked at my LastReboot.csv file. I looked at machines that had a LastLogonDate of today, 5/6/2015. Now, we have GPO that runs a PowerShell script and this script will write to the registry. I spot checked many of the machines that have a LastLogonDate of today and half did have the registry keys created by the PowerShell script but half did not. So on the machines that did not have the registry keys I wrote ran this script against each.
$pc = Read-Host "Enter the machine name"
Get-WmiObject win32_operatingsystem -ComputerName $pc | select csname, @{LABEL='LastBootUpTime';EXPRESSION={$_.ConverttoDateTime($_.lastbootuptime)}}
The lastbootuptime is not today on all of the machines I checked. why? How come LastLogonDate is not accurate? Or should I be using a different AD attribute?