Styjun

I am trying to get a list of all users defined in the Windows Server with the date-time of the last time it either logged in to the server or mapped/accessed a file share.
to do that I tried the following script:

Get-ADUser -Filter * -SearchBase "dc=whatever,dc=local" -ResultPageSize 0 -Prop CN,samaccountname,LastLogonTimestamp | Select CN,samaccountname,@N='Last‌Logon'; E=[DateTime]::FromFileTime($_.LastLogonTimestamp)

Which provided me with the following output:

CN samaccountname Last‌Logon 
-- -------------- ----------- 
Administrador Administrador 08/02/2019 17:30:00 
Invitado Invitado 01/01/1601 1:00:00 
krbtgt krbtgt 01/01/1601 1:00:00 
Maite maite 01/01/1601 1:00:00 
Mari Carmen mcarmen 01/01/1601 1:00:00 
Emilio emilio 01/01/1601 1:00:00 
Erica erica 01/01/1601 1:00:00 

I know for a fact that the users other than Administrator have accessed the server file shares (some of them map them as drives every day) but the only valid logon date obtained in the list is for Adminstrator.

It seems like this command is only reporting when a user actually logs into the server through RDP or the console.

How can I get a similar query to report each time a user accessed any of the servers shares?

You file share access creates a Network Logon (Logon Type 3) which doesn't affect the LastLogon attribute (and LastLogonTimestamp respectively). In this case you will have to obtain the information from the Domain Controllers event log, where all logons are logged. The following script will output the last logon date of any user with its logon type of the last 24h.

#86400000 = 24h
$FilterXPath = '*[System[EventID=4624 and TimeCreated[timediff(@SystemTime) <= 86400000]]]' 
$LogonEvents = Get-WinEvent -LogName Security -FilterXPath $FilterXPath

$Logons = foreach ($LogonEvent in $LogonEvents) 
 [PSCustomObject]@
 LogonDate = $LogonEvent.TimeCreated
 UserName = $LogonEvent.Properties[5].Value
 UserDomain = $LogonEvent.Properties[6].Value
 LogonType = $LogonEvent.Properties[8].Value
 


$LogonsGroupedByUserName = $Logons | Group-Object -Property UserName

foreach ($Group in $LogonsGroupedByUserName) 
 $Group.Group