Check a User's Last Login with PowerShell

Method 1: Single User Using LastLogonDate Recommended

The simplest and most reliable approach. Replace jsmith with the target user's SamAccountName:

Get-ADUser -Identity "jsmith" -Properties LastLogonDate |
    Select-Object Name, SamAccountName, LastLogonDate

Sample output:

Name        SamAccountName  LastLogonDate
----        --------------  -------------
John Smith  jsmith          6/28/2026 9:14:03 AM

Method 2: Single User Using lastLogon (Per DC)

Use this when you need the exact login time. Because lastLogon is not replicated, you must query every domain controller and find the most recent value. The raw value is a Windows FileTime integer and must be converted:

$user = "jsmith"
$latestLogin = $null

Get-ADDomainController -Filter * | ForEach-Object {
    $dc = $_.HostName
    $result = Get-ADUser -Identity $user -Properties lastLogon -Server $dc
    $loginTime = [DateTime]::FromFileTime($result.lastLogon)

    if ($loginTime -gt $latestLogin) {
        $latestLogin = $loginTime
    }
}

Write-Host "Most recent login for $user`: $latestLogin"

Method 3: Export All Users' Last Login to CSV

Useful for audits, license reviews, or identifying stale accounts. This queries the entire domain and exports to a CSV file in your current directory:

Get-ADUser -Filter * -Properties LastLogonDate, Enabled |
    Select-Object Name, SamAccountName, Enabled, LastLogonDate |
    Sort-Object LastLogonDate |
    Export-Csv -Path ".\AD_LastLogins.csv" -NoTypeInformation

Write-Host "Export complete: AD_LastLogins.csv"

To filter for accounts that haven't logged in within the last 90 days (useful for finding stale or inactive accounts):

$cutoff = (Get-Date).AddDays(-90)

Get-ADUser -Filter {LastLogonDate -lt $cutoff -and Enabled -eq $true} -Properties LastLogonDate |
    Select-Object Name, SamAccountName, LastLogonDate |
    Sort-Object LastLogonDate |
    Export-Csv -Path ".\Stale_Accounts.csv" -NoTypeInformation

Write-Host "Stale account export complete: Stale_Accounts.csv"