Подвесте на логог/логоф скрипт, и смотрите в AD пользователь ходил онзаходил:
Param(
[Parameter(Position=0)]
[ValidateSet("Logon","Logoff","Unknown")]
[string]$Status="Unknown"
)
#no spaces in the filter
[adsisearcher]$searcher="samaccountname=$env:username"
#find the current user
$find = $searcher.FindOne()
#get the user object
[adsi]$user = $find.Path
#define a string to indicate status
$note= @("{0} {1} to {2}" -f (Get-Date),$status.ToUpper(),$env:computername)
[array]$NewVals = @()
$NewVals = try {
($user.GetEx('url'))[0..10]
}
catch {
@()
}
$newVals += $note
#DEBUG, output values in ISE
#$NewVals | out-host
#update the user property
$user.PutEx(2, 'url', $NewVals )
#commit the change
$user.SetInfo()
#DEBUG, output values in ISE
#$user.GetEx('url')