使用 WMI Explorer(或任何其他工具)，我用户的 LastLogon 时间戳显示的是过时值而不是当前日期(因为我目前正在使用这台 PC):

SELECT * FROM Win32_NetworkLoginProfile
--
LastLogon = 20150212180405.000000+120

同时，其他域用户被列为 LastLogon 作为当前日期，所以这只是我的用户的问题。

另一方面，NetUsers正在按预期报告当前日期:

DOMAIN\user    user name    2015/03/10 10:14

WMI错误结果的原因是什么？

环境:Win 7 x64，域用户添加到本地管理员组。

最佳答案

我很高兴收到来自 NetUsers.exe 的 Optimum X 开发人员的答复，非常专业且内容丰富。

他们用 c++ 编写程序，跟踪登录时间的最可靠方法是读取位于“HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList”下的每个配置文件的注册表项上的 LastWriteTime

在我用 WMI 亲自尝试了每个类之后，它们都让我失望了，所以我求助于 pInvoke 来使用 C# 读取隐藏的注册表属性“LastWriteTime”

这是您要在 HKLM RegistryKey 上调用的主要函数:

    private static DateTime GetHKLMRegistryKeyLastWriteTime(RegistryKey key, string RemoteComputer)
    {
        DateTime LastWriteTime = DateTime.MinValue;
        //set RegSAM access
        RegSAM desiredSAM = RegSAM.Read;
        //set key to same navigation (win32 vs win64)
        if (key.View == RegistryView.Registry32)
        {
            desiredSAM |= RegSAM.WOW64_32Key;
        }
        else if(key.View == RegistryView.Registry64)
        {
            desiredSAM |= RegSAM.WOW64_64Key;
        }

        //Get Registry Hive Key on RemoteComputer.
        UIntPtr computerRegHive = ConnectToRegistryHive(RemoteComputer, HKEY_LOCAL_MACHINE);

        if(computerRegHive != UIntPtr.Zero)
        {
            string keyPath = key.Name;
            int rootSeperatorIndex = keyPath.IndexOf(@"\");
            if (rootSeperatorIndex != -1)
            {
                keyPath = keyPath.Substring(rootSeperatorIndex + 1, keyPath.Length - (rootSeperatorIndex + 1));
            }

            UIntPtr computerRegKey = OpenRegistrySubKey(computerRegHive, keyPath, desiredSAM);
            //We no longer need computerRegHive, close!
            RegCloseKey(computerRegHive);
            if(computerRegKey != UIntPtr.Zero)
            {
                LastWriteTime = GetRegistryKeyLastWriteTime(computerRegKey);
                //We no longer need computerRegKey, close!
                RegCloseKey(computerRegKey);
            }
        }
        return LastWriteTime;
    }

下面是让它工作所需的东西:

public static uint HKEY_LOCAL_MACHINE = 0x80000002u;

[DllImport("advapi32.dll")]
private static extern int RegConnectRegistry(string lpmachineName, uint hKey, out UIntPtr phKResult);

[DllImport("advapi32.dll", CharSet = CharSet.Unicode)]
private static extern int RegOpenKeyEx(
        UIntPtr hKey,
        string subKey,
        int ulOptions, //Set to 0
        RegSAM samDesired, //Desired Access (win32/win64 & Read or ReadWrite)
        out UIntPtr hkResult);

[DllImport("advapi32.dll")]
private static extern int RegQueryInfoKey(
        UIntPtr hKey,
        StringBuilder lpClass,
        IntPtr lpcbClass,
        IntPtr lpReserved,
        IntPtr lpcSubKeys,
        IntPtr lpcbMaxSubKeyLen,
        IntPtr lpcbMaxClassLen,
        IntPtr lpcValues,
        IntPtr lpcbMaxValueNameLen,
        IntPtr lpcbMaxValueLen,
        IntPtr lpcbSecurityDescriptor,
        [Out][Optional]out FILETIME lpftLastWriteTime
    );

[DllImport("advapi32.dll")]
private static extern int RegCloseKey(UIntPtr hKey);

[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool FileTimeToSystemTime([In] ref FILETIME lpFileTime, out SYSTEMTIME lpSystemTime);

[Flags]
public enum RegSAM
{
    QueryValue = 0x0001,
    SetValue = 0x0002,
    CreateSubKey = 0x0004,
    EnumerateSubKeys = 0x0008,
    Notify = 0x0010,
    CreateLink = 0x0020,
    WOW64_32Key = 0x0200,
    WOW64_64Key = 0x0100,
    WOW64_Res = 0x0300,
    Read = 0x00020019,
    Write = 0x00020006,
    Execute = 0x00020019,
    AllAccess = 0x000f003f
}

    [StructLayout(LayoutKind.Sequential)]
    public struct FILETIME
    {
        public uint LowPart;
        public uint HighPart;
    };

    [StructLayout(LayoutKind.Sequential, Pack = 2)]
    public struct SYSTEMTIME
    {
        public ushort Year;
        public ushort Month;
        public ushort DayOfWeek;
        public ushort Day;
        public ushort Hour;
        public ushort Minute;
        public ushort Second;
        public ushort Milliseconds;

        public SYSTEMTIME(DateTime dt)
        {
            dt = dt.ToUniversalTime();
            Year = Convert.ToUInt16(dt.Year);
            Month = Convert.ToUInt16(dt.Month);
            DayOfWeek = Convert.ToUInt16(dt.DayOfWeek);
            Day = Convert.ToUInt16(dt.Day);
            Hour = Convert.ToUInt16(dt.Hour);
            Minute = Convert.ToUInt16(dt.Minute);
            Second = Convert.ToUInt16(dt.Second);
            Milliseconds = Convert.ToUInt16(dt.Millisecond);
        }

        public SYSTEMTIME(ushort year, ushort month, ushort day, ushort hour = 0, ushort minute = 0, ushort second = 0, ushort millisecond = 0)
        {
            Year = year;
            Month = month;
            Day = day;
            Hour = hour;
            Minute = minute;
            Second = second;
            Milliseconds = millisecond;
            DayOfWeek = 0;
        }

        public static implicit operator DateTime(SYSTEMTIME st)
        {
            if (st.Year == 0 || st == MinValue)
                return DateTime.MinValue;
            if (st == MaxValue)
                return DateTime.MaxValue;
            return new DateTime(st.Year, st.Month, st.Day, st.Hour, st.Minute, st.Second, st.Milliseconds, DateTimeKind.Utc);
        }

        public static bool operator ==(SYSTEMTIME s1, SYSTEMTIME s2)
        {
            return (s1.Year == s2.Year && s1.Month == s2.Month && s1.Day == s2.Day && s1.Hour == s2.Hour && s1.Minute == s2.Minute && s1.Second == s2.Second && s1.Milliseconds == s2.Milliseconds);
        }

        public static bool operator !=(SYSTEMTIME s1, SYSTEMTIME s2)
        {
            return !(s1 == s2);
        }

        public static readonly SYSTEMTIME MinValue, MaxValue;

        static SYSTEMTIME()
        {
            MinValue = new SYSTEMTIME(1601, 1, 1);
            MaxValue = new SYSTEMTIME(30827, 12, 31, 23, 59, 59, 999);
        }

        public override bool Equals(object obj)
        {
            if (obj is SYSTEMTIME)
                return ((SYSTEMTIME)obj) == this;
            return base.Equals(obj);
        }

        public override int GetHashCode()
        {
            return base.GetHashCode();
        }
    }


    /// <summary>
    /// When a handle returned is no longer needed, it should be closed by calling RegCloseKey.
    /// </summary>
    private static UIntPtr ConnectToRegistryHive(string RemoteComputer, uint hKey)
    {
        UIntPtr computerRegHive = UIntPtr.Zero;
        RegConnectRegistry(@"\\" + RemoteComputer, hKey, out computerRegHive);
        return computerRegHive;
    }

    /// <summary>
    /// When a handle returned is no longer needed, it should be closed by calling RegCloseKey.
    /// </summary>
    private static UIntPtr OpenRegistrySubKey(UIntPtr CurrentHKey, string SubKeyName, RegSAM desiredSAM)
    {
        UIntPtr hRegKey = UIntPtr.Zero;
        RegOpenKeyEx(CurrentHKey, SubKeyName, 0, desiredSAM, out hRegKey);
        return hRegKey;
    }

    private static DateTime GetRegistryKeyLastWriteTime(UIntPtr hKey)
    {
        FILETIME ft = new FILETIME();

        int ret = RegQueryInfoKey(hKey, null, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, 
                                  IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, out ft);
        if(ret == 0)
        {
            SYSTEMTIME st = new SYSTEMTIME(DateTime.MinValue);
            FileTimeToSystemTime(ref ft, out st);
            //Thanks to a highly developed SYSTEMTIME struct which has a DateTime implicit operator .... it's like magic!
            DateTime LastWriteTime = st;
            return LastWriteTime.ToLocalTime();
        }
        return DateTime.MinValue;
    }

至于 Win32_NetworkLoginProfile 失败的原因，机器正在从域 Controller 中提取帐户的日期戳，因此对于机器上的实际本地登录是完全不准确的。

关于windows - 从 Win32_NetworkLoginProfile 返回错误的 LastLogon，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/28959160/