[Kazun]

DOMAIN - Заменить на NetBios имя своего домена

Код:

$filter = "*[System[EventID=4624] and (EventData[Data[@Name='LogonType']=2] or EventData[Data[@Name='LogonType']=10]) 
	and EventData[Data[@Name='TargetDomainName']='DOMAIN']]"
Get-ADComputer -Filter "Enabled -eq '$true' -and DnsHostName -like '*'" | Foreach {
	$event = $mail = $user = $null
	$event = Get-WinEvent -FilterXPath $filter -LogName Security -MaxEvent 1 -ComputerName $_.DnsHostName
	
	if($event) {
		$user = $event.Properties[5].Value
		if($user) {
			$mail = (Get-ADUser $user -Properties mail).mail
		}
	}
	
	[pscustomobject]@{
		ComputerName = $_.Name
		UserName = $user
		MailAddress = $mail
	}
}