Re: Windows 2003 Last Login

From: Torgeir Bakken \(MVP\) (Torgeir.Bakken-spam_at_hydro.com)
Date: 02/04/05 

Date: Fri, 04 Feb 2005 19:56:23 +0100

Bad Beagle wrote:

> I am using the following script to get my last login time of users. It
> seems to work for me yet I am reading a lot of documentation that says this
> lastlogin time field only updates every 7 days. Is anyone else using a
> similar script and getting positive results? I only have 2 DC's.
>
> On Error Resume Next
> Dim User
> Dim UserName
> Dim UserDomain
> UserDomain = InputBox("Enter the name of the domain:")
> UserName = InputBox("Enter the name of the user:")
> Set User = GetObject("WinNT://" & UserDomain & "/" & UserName & ",user")
> MsgBox "The last time " & UserName & " logged on was: " & vbCRLf & vbCRLf &
> User.LastLogin
Hi

The WinNT property LastLogin that you use is updated at each user logon
on the domain controller that authenticates the user.

The Lastlogin attribute is not replicated. This means that a different
value for the user could be stored in every Domain Controller in the
domain. You need to bind to each DC and determine the latest date.

The one that is replicated, is the LDAP property lastLogonTimestamp,
but this value is only updated when the user logs in if a week has
passed since the last update (so it is usable only to see if an account
have been active on a weekly basis).

Also, the domain functional level needs to have been set to Windows
Server 2003 for this to happen.

 From the docs:

http://msdn.microsoft.com/library/en-us/adschema/ad/adam_a_lastlogontimestamp.asp

<quote>
Last-Logon-Timestamp
This is the time that the user last logged into the domain. This value
is only updated when the user logs in if a week has passed since the
last update. This value is replicated.
</quote>

http://www.microsoft.com/resources/documentation/WindowsServ/2003/enterprise/proddocs/en-us/dsadmin_concepts_accounts.asp

<quote>
When the domain functional level has been set to Windows Server 2003,
a new lastLogonTimestamp attribute is used to track the last logon
time of a user or computer account.
</quote>

The above is relevant for both user and computer accounts. Note the
once a week update only part and the Windows Server 2003 domain
functional level prerequisite.

Raise the domain functional level; Windows Server 2003
http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/sag_changedomlevel.asp

Raising the Roof on Domain Functional Levels
http://www.networking.earthweb.com/netos/article.php/3298531 

-- 
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx

Relevant Pages

  • Re: Windows 2003 Last Login
    ... >> lastlogin time field only updates every 7 days. ... the domain functional level needs to have been set to Windows ... > When the domain functional level has been set to Windows Server 2003, ... > torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway ...
    (microsoft.public.scripting.vbscript)
  • Re: Disabling old account script needed
    ... When the domain functional level has been set to Windows Server 2003, a new lastLogonTimestamp attribute is used to track the last logon time of a user or computer account. ... torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway ...
    (microsoft.public.windows.server.active_directory)
  • Re: How to find "LastLogonTime" for users
    ... Mueller [MVP] and I actually have some queries. ... if the domain functional level is set to Windows Server ... > torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway ...
    (microsoft.public.windows.server.scripting)
  • Re: I want to add fields to user report
    ... When the domain functional level has been set to Windows Server 2003, ... -- torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
    (microsoft.public.scripting.vbscript)
  • Re: Disabling old account script needed
    ... > lastLogonTimestamp, but this value is only updated when the user logs ... > When the domain functional level has been set to Windows Server 2003, ... > time of a user or computer account. ...
    (microsoft.public.windows.server.active_directory)