Re: force replication (lastLogonTimestamp)

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Cam wrote:

Is is possible to force AD properties (specifically lastLogonTimestamp) to
replicate?

Here is my situation. A script that runs once a week and uses
lastLogonTimestamp to indentify accounts that have not been logged into
for
30 days and disables them. Here is an example case based on the evidence I
have seen. On July 2, the script disables account_A. On July 4, the admin
enables the account so that account_A can log in. On July 9, the script
runs
again. Because lastLogonTimestamp replicates every 14 days, and because
the
script is looking at a different DC than account_A logged in to, the
script
sees an old lastLogonTimestamp and disables the account.

If I could force lastLogonTimestamp to replicate (rather than waiting for
the 14 days), then the script will always see the correct valus for
lastLogonTimestamp. Is there a way to do this, possibly by issuing a ADSI
command in VBScript?

Actually, lastLogonTimeStamp replicates like any other attribute. The
problem is that the value is not updated during logon unless the old value
is more than 14 days in the past. Forcing replication will not help you. You
need some way to force the system to update lastLogonTimeStamp when the user
logs on. Off hand I can't think if a way to do this. One solution is to not
run the script until 14 days after any accounts have been enabled. Another
is to use lastLogon instead, which would require querying every DC.

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--


.

Relevant Pages

  • Re: VB Script - Last Logon
    ... I want to send the result from the script to a txt or csv ... shortend the time it takes to replicate this data to all DC's down to ... The whole point of retrieving the lastLogonTimeStamp attribute is so you ... This command creates the ...
    (microsoft.public.vb.general.discussion)
  • Re: force replication (lastLogonTimestamp)
    ... lastLogonTimestamp to indentify accounts that have not been logged into ... On July 2, the script disables account_A. ... Because lastLogonTimestamp replicates every 14 days, ... lastLogonTimeStamp replicates like any other attribute. ...
    (microsoft.public.windows.server.active_directory)
  • Re: msDS-LogonTimeSyncInterval ?
    ... Could I then just give all those old accounts a value and then it should ... I find it odd that I get absolutely ZERO returns from the query ... > on lastLogonTimeStamp because not all auth methods update that value. ... >> The lastlogontimestamp on the user does seem to set and perhaps replicate ...
    (microsoft.public.windows.server.active_directory)
  • Re: HDR questions
    ... Below is shell script I use to setup a replicate in 10. ... want to take a backup while I am setting up the replicate. ... there is also a copy of the production database ...
    (comp.databases.informix)
  • Re: Determine Last Date of Computer Logon in AD Domain
    ... lastLogon is not replicated, but lastLogonTimeStamp DOES replicate ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... you might consider using lastLogonTimestamp attribute - but keep in mind that it's not updated at every logon... ... The message was checked by ESET Smart Security. ...
    (microsoft.public.windows.server.active_directory)