Every now an then you might need to know who logged on and when was the last logon of which user to a specific workstation as well as the size of each user profile. For this I once wrote the PowerShell script you can find below. It does a WMI query against a list of one or more target computers and reads out the information reporting it back.
As input parameter use a comma separated list of computer names – those must be reachable and administrative accessible (you need at least admin rights on the target system). You then get a output set per profile.
The output can e.g. be transformed with the parameter |ft to see it in table format – like typical in PowerShell.
Output values are:
- ComputerName
- ProfileName
- ProfilePath
- ProfileType
- Temporary
- Roaming
- Mandatory
- Corrupted
- local
- IsinUse
- IsSystemAccount
- Size
- this needs to most processing time – it is a manual size check including even temp files.. – other then what Windows shows you
- LastUseTime
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 | [cmdletbinding()] [cmdletbinding()] param ( [parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)] [string[]]$ComputerName = $env:computername ) foreach ($Computer in $ComputerName) { $Profiles = Get-WmiObject -Class Win32_UserProfile -Computer $Computer -ea 0 foreach ($profile in $profiles) { try { $objSID = New-Object System.Security.Principal.SecurityIdentifier($profile.sid) $objuser = $objsid.Translate([System.Security.Principal.NTAccount]) $objusername = $objuser.value } catch { $objusername = $profile.sid } switch($profile.status){ 1 { $profileType="Temporary" } 2 { $profileType="Roaming" } 4 { $profileType="Mandatory" } 8 { $profileType="Corrupted" } default { $profileType = "LOCAL" } } $size = 0 try{ $profilepath=$profile.localpath -replace "C:","\\$Computer\C$" $size=(dir $profilepath -recurse -force -ea silentlycontinue | Measure-Object ‘length’ -sum -Maximum).sum $size=[math]::Round(($size/1GB),2) #$size={{0:n2} -f $size} $size2=[string]::Format("{0:0.00} GB", $size) } catch { $size = -1 } $User = $objUser.Value try { $ProfileLastUseTime = ([WMI]"").Converttodatetime($profile.lastusetime) } catch { $ProfileLastUseTime = "" } $OutputObj = New-Object -TypeName PSobject $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.toUpper() $OutputObj | Add-Member -MemberType NoteProperty -Name ProfileName -Value $objusername $OutputObj | Add-Member -MemberType NoteProperty -Name ProfilePath -Value $profile.localpath $OutputObj | Add-Member -MemberType NoteProperty -Name ProfileType -Value $ProfileType $OutputObj | Add-Member -MemberType NoteProperty -Name IsinUse -Value $profile.loaded $OutputObj | Add-Member -MemberType NoteProperty -Name IsSystemAccount -Value $profile.special $OutputObj | Add-Member -MemberType NoteProperty -Name Size -Value $size2 $OutputObj | Add-Member -MemberType NoteProperty -Name LastUseTime -Value $ProfileLastUseTime $OutputObj } } |
