Check User Login History in Active Directory with PowerShell

Active Directory provides several methods for determining when a user has logged on to the domain. The time of a user’s last successful authentication in Active Directory can be retrieved from the lastLogon attribute (which is updated only on the domain controller that handled the authentication) or from the lastLogonTimestamp attribute (replicated across all DCs, but only if it is 14 days or more older). The values of these user attributes can be viewed using either the AD attribute editor or the Get-ADUser PowerShell cmdlet.  However, this will only give you the last time the user logged in. Sometimes, you need to view the history of a user’s logon activity in a domain over an extended period of time.

In this article, we’ll cover how to configure a Group Policy to audit user authentication events in a domain and use PowerShell to collect information about successful user logons from the domain controller’s security logs. With a simple PowerShell script, you can quickly retrieve a complete history of user activity in a domain, including logon times and the computers from which they logged on.

[contents h2]

Configure User Logon Audit Policy in Active Directory

To collect successful and failed user logon events in the security logs of the AD domain controller, you must configure an audit policy.

1. Open the domain GPO management console (GPMC.msc)
2. Create a new GPO and link it to the domain root (it is not recommended to edit the Default Domain Policy)
3. Open the new GPO settings and go to Computer Configuration -> Policies -> Windows Settings -> Security Settings –> Advanced Audit Policy Configuration -> Audit Policies -> Logon/Logoff
4. Enable two audit policies (Audit Logon and Audit Other Logon/Logoff Events). Select Success and (optionally) Failure options in the audit policy settings to register both successful and failed logons in the Security log on the DCs and computers.
   
5. Next, enable auditing for Kerberos authentication events. Go to Audit Policies -> Account Logon –> Audit Kerberos Authentication Service -> enable audit of Success events.
6. Save the changes to the GPO
7. Wait for the new GPO to be replicated between DCs
8. Domain controllers apply GPO settings every 5 minutes. Or manually update the Group Policy settings by using the command: gpupdate /force

Now, when a user logs in to any computer in an Active Directory domain, an Event ID 4624 (An account was successfully logged on) will appear in the Security log of the domain controller that authenticates the user (LogonServer). The event description includes the authenticated user’s Account Name, Workstation Name, or IP address (Source Network Address) of the computer from which the logon was performed.

The Logon Type field of the event contains the user’s logon type (code). We may be interested in the following login codes:

• Logon Type 2 – interactive (local) login to computer: An account was successfully logged on
• Logon Type 3 – Network logon (occurs when a user authenticates on a DC, connects to a shared network folder, printer, or IIS service).
• Logon Type 10 – Remote Interactive logon – remote login via terminal services (RDP), shadow connection, or Remote Assistance. This event is used to monitor and analyze the activity of Remote Desktop Services users.
• Logon Type 7 – User session unlock event (after manual or automatic computer screen lock after inactivity).

You can also track a user’s domain login by monitoring the Kerberos ticket issuance event during user authentication.

Event ID 4768:

A Kerberos authentication ticket (TGT) was requested.

Event 4768 contains the name (or IP address) of the computer and the user account (Account Name or User ID) that received a Kerberos ticket, indicating successful authentication.

How to Get AD User Login History with PowerShell

You can use the Get-Eventlog PowerShell cmdlet to get all events from the domain controller’s event logs, filter them by the EventID you want, and display information about the time when a user authenticated in the domain and a computer used to log on. Since there may be multiple domain controllers in your domain and you may want to get a user logon history from each of them, use the Get-ADDomainController cmdlet (from the AD module for Windows PowerShell). The cmdlet allows you to get the list of all DCs in your domain.

Let’s look at how to use PowerShell to extract user login events from domain controller security logs. Because a domain can have multiple domain controllers, each with its own Security log, you will need to search for events on each DC

The original version of the script used the Get-Eventlog cmdlet to retrieve events with a specific EventID from the domain controllers’ security logs. A sample PowerShell script that lists the logon events for a specified user for the last 2 days from all domain controllers:

# A username for which you want to view the logon history
$checkuser='*jbrown*'
# Get user login history for the last 2 days (you can change this value)
$startDate = (get-date).AddDays(-2)
$DCs = Get-ADDomainController -Filter *
foreach ($DC in $DCs){
$logonevents = Get-Eventlog -LogName Security -InstanceID 4624 -after $startDate -ComputerName $dc.HostName
foreach ($event in $logonevents){
if (($event.ReplacementStrings[5] -notlike '*$') -and ($event.ReplacementStrings[5] -like $checkuser)) {
# Remote (Logon Type 10)
if ($event.ReplacementStrings[8] -eq 10){
write-host "Type 10: Remote Logon`tDate: "$event.TimeGenerated "`tStatus: Success`tUser: "$event.ReplacementStrings[5] "`tWorkstation: "$event.ReplacementStrings[11] "`tIP Address: "$event.ReplacementStrings[18] "`tDC Name: " $dc.Name
}
# Network(Logon Type 3)
if ($event.ReplacementStrings[8] -eq 3){
write-host "Type 3: Network Logon`tDate: "$event.TimeGenerated "`tStatus: Success`tUser: "$event.ReplacementStrings[5] "`tWorkstation: "$event.ReplacementStrings[11] "`tIP Address: "$event.ReplacementStrings[18] "`tDC Name: " $dc.Name
}
}
}
}

The output is a table that includes the user’s logon history, the computers from which the user authenticated, and the domain controllers that processed the logon.

The main drawback of the Get-EventLog cmdlet is its slow event search performance. Instead, it’s better to use the faster Get-WinEvent cmdlet to find events. Here’s an example of a similar PowerShell script to get logon events from all domain controllers, which will search much faster

$TargetUsername = 'jbrown'  
$StartTime = (Get-Date).AddHours(-48)
$LogonTypeDescriptions = @{
    '2'  = 'Interactive'
    '3'  = 'Network'
    '7'  = 'Unlock'
    '10' = 'RemoteInteractive'
    '11' = 'CachedInteractive'
}
$DomainControllers = Get-ADDomainController -Filter *
$LogonEvents = @()
foreach ($DC in $DomainControllers) {
    $FilterHashtable = @{
        LogName   = 'Security'
        ID        = 4624
        StartTime = $StartTime
    }
    $Events = Get-WinEvent -ComputerName $DC.HostName -FilterHashtable $FilterHashtable -ErrorAction SilentlyContinue
    foreach ($Event in $Events) {
        $EventData = [xml]$Event.ToXml()
        $EventUser = $EventData.Event.EventData.Data[5].'#text'
        $LogonTypeCode = $EventData.Event.EventData.Data[8].'#text'
        if ($EventUser -eq $TargetUsername) {
            $LogonEvent = [PSCustomObject]@{
                TimeCreated  = $Event.TimeCreated
                ComputerName = $EventData.Event.EventData.Data[18].'#text'  
                IPAddress    = $EventData.Event.EventData.Data[18].'#text'  
                Username     = $EventUser
                LogonType    = $LogonTypeDescriptions[$LogonTypeCode] 
                DCName       = $DC.HostName
            }
            $LogonEvents += $LogonEvent
        }
    }
}

Use the Export-Csv cmdlet to export a user’s logon history to a CSV file:

$FileName = "C:\PS\LogonEvents" +  $startDate.ToString('yy_MM_dd')  + ".csv"
$LogonEvents| Export-Csv $FileName -Append -NoTypeInformation -encoding UTF8

Get Domain User Logon History Based on Kerberos Events

You can also get a user authentication history in the domain based on the event of a Kerberos ticket being issued (TGT Request, EventID 4768). In this case, fewer events will appear in the output because network logins and DC folder access events (such as when retrieving GPO files or running login scripts) are excluded. The following PowerShell script displays information about all user logons for the past 24 hours:

$alluserhistory = @()
$startDate = (get-date).AddDays(-1)
$DCs = Get-ADDomainController -Filter *
foreach ($DC in $DCs){
$logonevents = Get-Eventlog -LogName Security -InstanceID 4768 -after $startDate -ComputerName $dc.HostName
foreach ($event in $logonevents){
if ($event.ReplacementStrings[0] -notlike '*$') {
$userhistory = New-Object PSObject -Property @{
UserName = $event.ReplacementStrings[0]
IPAddress = $event.ReplacementStrings[9]
Date = $event.TimeGenerated
DC = $dc.Name
}
$alluserhistory += $userhistory
}
}
}
$alluserhistory

Note that in this case, you won’t see any logon events for users authenticated by clients or applications that use NTLM instead of Kerberos