Check out how many users or computers are authenticated in a given Domain Controller (PowerShell)

Introduction

This PowerShell Script illustrates how to check that how much users are authenticated in Domain Controllers.

Scenarios

In many cases, if user wants to check how many user accounts are authenticated in domain control? Normally, user will search the event viewer for the logon events. There is no direct way to get that information, it will be really time consuming. Now, we can use the script to do it.

Script

Step 1: Click Start, type powershell in the search box on the Start Menu, right-click the Windows PowerShell icon, and then click Run Windows PowerShell as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

Step 2: Run the script in the Windows PowerShell Console, You can type the command Get-Help <Script Path> -full to display the entire help file for this function, such as the syntax, parameters, or examples

For example, type Get-Help E:\ UsersAreAuthenticatedInDomainController.ps1 -Full as shown in the following figure.

Step 3: If you want to list all of user account are authenticated in Domain Controller in two days. You can type the command E:\ UsersAreAuthenticatedInDomainController.ps1 –Day 2 for example as below

Here are some code snippets for your references. To get the complete script sample, please click the download button at the beginning of this page.

PowerShell

Edit|Remove

[String]$EventLogNames=@("Security")
[DateTime]$EventStartDate = (((Get-Date).addDays(-$Date).date))
[DateTime]$EventEndTime = (Get-Date)
 
$EventCritea = @{Id="4624"; Logname=$EventLogNames; StartTime=$EventStartDate; EndTime=$EventEndTime}
 
[regex]$RegexAccountName = "Account Name:\s+\w+.*"
[regex]$RegexDomainName = "Account Domain:\s+\w+.*"
 
 
$WinEvent = Get-WinEvent -ComputerName $Env:COMPUTERNAME -FilterHashTable $EventCritea

[String]$EventLogNames=@("Security") 
[DateTime]$EventStartDate = (((Get-Date).addDays(-$Date).date)) 
[DateTime]$EventEndTime = (Get-Date) 
  
$EventCritea = @{Id="4624"; Logname=$EventLogNames; StartTime=$EventStartDate; EndTime=$EventEndTime} 
  
[regex]$RegexAccountName = "Account Name:\s+\w+.*" 
[regex]$RegexDomainName = "Account Domain:\s+\w+.*" 
  
  
$WinEvent = Get-WinEvent -ComputerName $Env:COMPUTERNAME -FilterHashTable $EventCritea

Prerequisite

Windows PowerShell 2.0

Additional Resources
Get-WinEvent