Display last logon time for a user...

Hello!

I have the following problem: I have to display the last logon-time of
a user when the user logs on to his Computer (Active Directory-Logon).
So when a user logs on some window opens that says: Your last Logon
time was...
Sounds easy, but isn't... first thing that comes in mind is: Query the
'lastLogon'-Attribute in AD. I know it's not replicated between DCs but
that isn't the problem (yes, it's slow, but i can query all of them..)
- the bigger problem is: When a user logs on the last logon time is
NOW. The attribute is overwritten in the moment the user logs on...
So, another idea was born: We write a Service which runs on each DC,
parses some events from the Security-Eventlog and checks the
logon-events, writes the time of the last logon to a File which is
stored in sysvol, my logon-Script reads this file and displays the
information to the user.
Sounds good, but i didn't find any event that occurs only when a user
is logging on - all logon-events occur again when the user is e.g.
connecting a network-share, accessing a network-share after a while,
when the kerberos-ticket is renewed or when the user is logging off...

Does anybody have an idea how this problem can be solved?! Or is it
just impossible?

Thank you.

Tom.

.

Relevant Pages

  • RE: Display last logon time for a user...
    ... why don't you just write a logon script that checks a text file on a network ... share and displays the last logon time, then writes another line to the text ... So when a user logs on some window opens that says: ... connecting a network-share, accessing a network-share after a while, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Auditing Logon Events
    ... > I have just been trying to set up auditing on my 2k DC to log every time a ... > user logs onto the system. ... Account logon events will log every request to the DC for authentication; ...
    (microsoft.public.windows.server.active_directory)
  • Re: Similar User Names - OWA Access
    ... John Doe), so one user logs on as John and the ... I can see this in 5.5 because you entered the alias first (at the big ... orange screen) and then the logon. ...
    (microsoft.public.exchange.misc)
  • Re: Multiple 538 and 540 IDs in 2003 server Security Events Log?
    ... During every domain logon from a workstation, ... In Vista we've added share access auditing and RPC auditing so that you can ... you can generate logon events but suppress logoff events, ... ID's appear again several times when the user logs off. ...
    (microsoft.public.windows.server.security)
  • Re: Remote Registry
    ... The HKCU key is a child or pseudo hive created when the user logs on. ... You will either have to load each one of these hives individually to make the changes, not a viable option for a large network with many users. ... An easy way would be to have the changes done through the logon mechanism, have a script or batch file do the changes for the users as they logon. ... When i try to connect to a remote registry through regedit.exe and after ...
    (microsoft.public.win2000.registry)