check when was the last time a windows vm was logged in

[roneng]

Hi

I am trying to find a way to check when was the last time a VM was logged in, in order to know if i can delete them if not being used.

thanks

[LucD]

You mean logged in to the OS running on the guest ?

If yes, what type of OS do you run on the guest ?

[roneng]

yep, i mean when was the last a user (any user) logged in to the OS which is XP

I want to be able to select some VM and know if someone uses them.

[LucD]

If you use PowerShell v2 you could use the Get-Eventlog cmdlet provided you audit the logon/logoff activity in the eventlog.

If that is not the case then you could look at the last modification date on the ntuser.dat file for all user profiles, provided you store the profiles locally of course.

There are probably numerous other methods but then I would advise you to ask in one of the PowerShell forums.

A lot depends how your guests and users are configured.

[RParker]

You can't do it. I have tried, done lots of research. You can tell when a user logged in, by the security log, but that won't tell you if the machine is still in use.

Case in point, SQL server. If they log into SQLthe logs never get updated, so you won't see they are using the machine. You shut that VM down, they will complain.

There is no way to really tell if a machine is being used or not, unless you turn it off and they complain to bring it back up. Other than that, no log or updates, or anything can tell if you if a Windows VM is still being used. There are modifications on the server being done all the time, so you can't even look at the file modifications to see if that helps, there is just no way.

Make notes in the VM, set termination dates, and make people stick to them, that's the only way to truly tell if they are needed or not.

[RParker]

> ntuser.dat file for all user profiles, provided you store the profiles locally of course.

That doesn't work, because if the server is used as a web, SQL or some other Client / Server project that file may or may not be touched. In our case they use the same local account to login to all the machines, because we have a separate domain for development. So they share the same user accounts, nothing special about the machines, they do builds and C++ / Java development. So no reason for separate users.

There are many ways to identify machines, but NONE of them can tell you with any degree of certainty if the machine is STILL in use, because many progams don't need Windows authentication to login to the services.

[roneng]

yes,

this is what i want to know - when was the last user login.

Thats what important to me.

How can i do that?

[devcom]

I'd like to know this as well. We have over 500 VMs at this point and there is no way all of them are being used. The problem is our user community is useless when it comes to either informing us a VM is no longer needed or responding to queries about VMs they no longer need.