public static IEnumerable <LastLoggedOnUser> Get_WMIRegLastLoggedOn(Args_Get_WMIRegLastLoggedOn args = null)
{
if (args == null)
{
args = new Args_Get_WMIRegLastLoggedOn();
}
var LastLoggedOnUsers = new List <LastLoggedOnUser>();
foreach (var Computer in args.ComputerName)
{
// HKEY_LOCAL_MACHINE
var HKLM = 2147483650;
// try to open up the remote registry key to grab the last logged on user
try
{
var Reg = WmiWrapper.GetClass($@"\\{Computer}\ROOT\DEFAULT", "StdRegProv", args.Credential);
var Key = @"SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI";
var Value = "LastLoggedOnUser";
var outParams = WmiWrapper.CallMethod(Reg, "GetStringValue", new Dictionary <string, object> {
{ "hDefKey", HKLM }, { "sSubKeyName", Key }, { "sValueName", Value }
}) as System.Management.ManagementBaseObject;
var LastUser = outParams["sValue"] as string;
var LastLoggedOn = new LastLoggedOnUser
{
ComputerName = Computer,
LastLoggedOn = LastUser
};
LastLoggedOnUsers.Add(LastLoggedOn);
}
catch
{
Logger.Write_Warning("[Get-WMIRegLastLoggedOn] Error opening remote registry on $Computer. Remote registry likely not enabled.");
}
}
return(LastLoggedOnUsers);
}
public static IEnumerable <LastLoggedOnUser> Get_LastLoggedOn(Args_Get_WMIRegLastLoggedOn args = null)
{
return(GetWMIRegLastLoggedOn.Get_WMIRegLastLoggedOn(args));
}
