Q: Last time User Profile was used on list of workgroup computers I need to search through a list of work group computers via the Users Profile Folder \computer\C$\users. I don't always know the full login name, or naming convention of the accounts, so need to invoke the use of wildcards e.g Simon Heffner may have a login folder (according to naming convention) of Heffensi, Simonhe or Heffnsi, that type of thing. 
Using the last modified date of a certain file within the user folder I want to list computers he's possibly logged into at the time the script is ran, or at least within the last 2 weeks just in case they use / share more than one.  
Research leads me to this file being a good identifier of logon activity.
"\\%%A\C$\Users\*%search%*\AppData\Local\Microsoft\Windows\UsrClass.dat"

I have some code that works but only so far and needs to be improved.
:start
CLS
echo.
echo ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
set /p search=Input search string:-

for /f "usebackq tokens=*" %%A in ("%~dp0hostsfs.txt") do (

if exist "\\%%A\C$\Users\*%search%*" echo "%search% string was found in users folder on %%A" && powershell -Command "& Get-ChildItem "\\%%A\C$\Users\*%search%*\AppData\Local\temp"

)
pause & goto start

This works as intended, but does NOT use the file I refer to earlier (usrclass.dat) and if the user has logged on to multiple PC's (which is often)
the output from the power-shell command is overly verbose, in no order, and makes it quite difficult to find the recently used profiles. If I add the (usrclass.dat) file to the script, the power-shell command does nothing, it seems to be skipped. 
What I would like some assistance with is:-


*

*List item


Making the power-shell work with the (usrclass.dat) file for more accurate last logged on reporting.


*

*Make the output easier on the eye to search multiple logon times to the PC


--Output example--
"test string was found in users folder on TEST-PC2"


    Directory: \\TEST-PC2\C$\Users\test\AppData\Local


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----       09/11/2016     21:40                Temp

"test string was found in users folder on TEST-PC3"


    Directory: \\TEST-PC3\C$\Users\test\AppData\Local


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----       09/11/2015     21:40                Temp

"test string was found in users folder on TEST-PC4"


    Directory: \\TEST-PC4\C$\Users\test\AppData\Local


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----       09/11/2013     21:40                Temp

--Desired Output Example--
"test string was found in users folder on TEST-PC2"

User                                                  LastWriteTime
----                                                  -------------
test                                              11/11/2016 5:44:34 PM
test                                             1/15/2015 5:44:34 

"test string was found in users folder on TEST-PC3"

User                                                  LastWriteTime
----                                                  -------------
test                                             1/15/2015 5:44:34 

"test string was found in users folder on TEST-PC4"

User                                                  LastWriteTime
----                                                  -------------
test                                             1/15/2014 5:44:34

So from here I can easily see that test PC2 will be more than likely the PC he uses on the network, and then I can do tasks (load software silently etc.) to that PC and not the ones he clearly doesn't use. 
   echo ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
set /p search=Input search string:-

for /f "usebackq tokens=*" %%A in ("%~dp0hostsfs.txt") do (
For /d %%i in ("\\%%A\C$\Users\*%search%*") DO Psexec \\%%A -i net user %%i | find "Last logon"

) 

edit @16/11/2016 managed to suss it out, just in case some else needs this, I had to apply a multiplier to the %%i variable to expand just the folder name of the wildcard, which would always be the users log in, and then use that in the net use command in conjunction with psexec. Code Below.
:start
cls
echo.
echo :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
set /p search=Input search string:-

for /f "usebackq tokens=*" %%A in ("%~dp0hosts.txt") do (
echo.
For /d %%i in ("\\%%A\C$\Users\*%search%*") DO echo %%~nxi found on %%A & Psexec \\%%A net user %%~nxi | find "Last logon"
)
pause & goto start 

further edit this makes it a bit easier to read and separate multiple entries 
:start
cls
echo.
echo :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
set /p search=Input search string:-
for /f "usebackq tokens=*" %%A in ("%~dp0hosts.txt") do (
echo.
For /d %%i in ("\\%%A\C$\Users\*%search%*") DO (
echo %%~nxi found on %%A & (
echo. 
%~dp0Psexec.exe \\%%A net user %%~nxi | find "Last logon")
    )
)
echo :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
pause & goto start 


A: final answer, formatted properly
:start
cls
echo.
echo :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
set /p search=Input search string:-
for /f "usebackq tokens=*" %%A in ("%~dp0pxhosts.txt") do (
echo.
For /d %%i in ("\\%%A\C$\Users\*%search%*") DO (
echo %%~nxi found on %%A & (
echo. 
%~dp0Psexec.exe \\%%A net user %%~nxi | find "Last logon")
    )
)
echo :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
pause & goto start


A: Another method I've put together that produces very neat easy to read output is by querying the modified date of the user profiles usrclass.dat file (updates with every logon).
The previous answer using PSEXEC can be overly verbose and also reports error's all the time even though it finds the user the wildcard search. Hard to sift through with multiple entries found on several PC's.
fill pxhosts with list of hostnames & run. Just get nice list when ever its found of PC Username Last Modified Data (logon).
:start
cls
echo.
echo ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
set /p search=Input search string:-
echo.
for /f "usebackq tokens=*" %%A in ("%~dp0pxhosts.txt") do (
for /d %%i in ("\\%%A\C$\Users\*%search%*") DO (
for %%g in ("%%i\AppData\Local\Microsoft\Windows\usrclass.dat") DO Echo [PC]'%%A' [User]'%%~nxi' [Last Login]'%%~tg'
    )
)
echo.
echo ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
pause & goto start

Example Output:-
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Input search string:-adm

[PC]'DESKTOP-6285F8K' [User]'Admin' [Last Login]'09/11/2016 22:08'
[PC]'DESKTOP-6285F8K' [User]'Administrator' [Last Login]'25/10/2016 20:33'
[PC]'SRV-2008' [User]'admin' [Last Login]'21/11/2016 20:36'
[PC]'SRV-2008' [User]'Administrator' [Last Login]'21/11/2016 13:32'
[PC]'TEST-PC2' [User]'Admin' [Last Login]'21/11/2016 20:21'
[PC]'TEST-PC2' [User]'Administrator' [Last Login]'21/11/2016 20:48'

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Press any key to continue . . .

