Re: "Last logon time" & "Last time the account was authenticated by AD
- From: Tjeerd Seinen <t.seinen@xxxxxxxxxxxxxx>
- Date: Thu, 30 Aug 2007 08:10:35 -0700
On Aug 30, 4:23 pm, "Richard Mueller [MVP]" <rlmueller-
nos...@xxxxxxxxxxxxxxxxxxxx> wrote:
sekhar wrote:
Environment: Windows 200
Are "Last logon time" and "Last time the account was authenticated by AD"
the same? We have the requirement to identify the last time that account
was
used or accessed.
Currently I am generating a report that will query all the DCs and will
get
the updated Last logon time. But this is not always correct?
"Last logon time" & "Last time the account was authenticated by AD" the
same?
Yes, the last time an account authenticated in AD will be the date/time that
corresponds to the value of the lastLogon attribute. Just remember that the
lastLogon attribute is not replicated. For any user or computer object a
different value is saved on every Domain Controller. You must query all DC's
in the domain to get the largest (latest) value.
For most purposes, the lastLogonTimeStamp attribute will suffice. This
attribute is only updated during logon if the old value is at least 14 (by
default) days in the past, but the value is replicated. You only need to
query one DC (any DC). The value is accurate if it corresponds to a date
more than 14 days in the past.
Both attributes are Integer8, so they are 64-bit numbers representing dates
in UTC as the number of 100-nanosecond intervals since 12:00 AM January 1,
1601. The 64-bit value must be converted to a date/time in the current time
zone.
I believe you can use Joe Richards' oldcmp utility for this:
http://www.joeware.net/win/free/tools/oldcmp.htm
And I have a VBScript program to retrieve lastLogon for all users in the
domain linked here:
http://www.rlmueller.net/Last%20Logon.htm
--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab -http://www.rlmueller.net
--
The login time/date is only replicated in windows 2003, in windows
2000 you need to query every DC and merge the results.
You might consider http://www.tools4ever.com/products/utilities/reallastlogon/,
free trail with full functionality so will get your report.
.
- Follow-Ups:
- Re: "Last logon time" & "Last time the account was authenticated by AD
- From: Richard Mueller [MVP]
- Re: "Last logon time" & "Last time the account was authenticated by AD
- References:
- Re: "Last logon time" & "Last time the account was authenticated by AD
- From: Richard Mueller [MVP]
- Re: "Last logon time" & "Last time the account was authenticated by AD
- Prev by Date: Re: ADAMsync - must update source object to get a successful sync ?
- Next by Date: Re: Active Directory could not create the NTDS Settings object for this domain controller
- Previous by thread: Re: "Last logon time" & "Last time the account was authenticated by AD
- Next by thread: Re: "Last logon time" & "Last time the account was authenticated by AD
- Index(es):
Relevant Pages
|
