Hey PowerShell Guy ! : How Can I Get the Name of the Last User to Log on to a Computer?
Another rewrite of a Hey Scripting guy ! question in PowerShell, How Can I Get the Name of the Last User to Log on to a Computer?
as this time the answer involved the registry, there are a lot of ways in powershell.
First I show a oneliner (using get-item),
Then I will also show that, as in PowerShell the registry is just another Drive (Provider), you also can just cd (set-Location) into it.
do a dir (get-ChildItem) to find the key and use get-ItemProperty (gp) to show the value, and how to use select-object or format-* to select the properties ( this is more handy as Get-ItemProperty winlogon DefaultDomainName,DefaultUserName shows some default (PS*) properties standard.)
( I started PowerShell with the -NoProfile parameter, to show you the path in the Prompt, as I normaly have the Path in the Titlebar, as you CD into the registry like this, you see why I did that ;-) )
PS C:\PowerShell> (get-item 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon').GetValue('DefaultUserName')
mow
PS C:\PowerShell> cd hklm:
PS HKLM:\> cd 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
PS HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion> dir win*
Hive: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
SKC VC Name Property
--- -- ---- --------
0 13 Windows {AppInit_DLLs, LoadAppInit_DLLs, IconServiceLib, DdeSendTimeout...}
4 26 Winlogon {ReportBootOk, Userinit, VmApplet, AutoRestartShell...}
1 15 Winsat {MOOBE, LastExitCode, LastExitCodeCantMsg, LastExitCodeWhyMsg...}
0 1 WinSATAPI {LastFormalAssessment}
PS HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion> Get-ItemProperty Winlogon DefaultUserName
PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\W
inlogon
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
PSChildName : Winlogon
PSDrive : HKLM
PSProvider : Microsoft.PowerShell.Core\Registry
DefaultUserName : mow
PS HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion> Get-ItemProperty winlogon | select def*
DefaultDomainName DefaultPassword DefaultUserName
----------------- --------------- ---------------
thePowerShellGuy mow
PS HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion> Get-ItemProperty winlogon | format-list DefaultDomainName,Default
UserName
DefaultDomainName : thePowerShellGuy
DefaultUserName : mow
PS HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion>
You see that you can walk the Registry like it is a filesystem in PowerShell, working with the registry is easy as finding a file on your Harddrive.
And also note that we can use tabcompletion here !!!
cd so[tab]\mi[tab] etc ..
This saves a lot of typing and also is a great way to explore the registry !!
Enjoy,
Greeings /\/\o\/\/