Re: "Last logon time" & "Last time the account was authenticated by AD


"Tjeerd Seinen" <t.seinen@xxxxxxxxxxxxxx> wrote in message
news:1188486635.507550.5320@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
On Aug 30, 4:23 pm, "Richard Mueller [MVP]" <rlmueller-
nos...@xxxxxxxxxxxxxxxxxxxx> wrote:
sekhar wrote:
Environment: Windows 200

Are "Last logon time" and "Last time the account was authenticated by
AD"
the same? We have the requirement to identify the last time that
account
was
used or accessed.

Currently I am generating a report that will query all the DCs and will
get
the updated Last logon time. But this is not always correct?

"Last logon time" & "Last time the account was authenticated by AD" the
same?

Yes, the last time an account authenticated in AD will be the date/time
that
corresponds to the value of the lastLogon attribute. Just remember that
the
lastLogon attribute is not replicated. For any user or computer object a
different value is saved on every Domain Controller. You must query all
DC's
in the domain to get the largest (latest) value.

For most purposes, the lastLogonTimeStamp attribute will suffice. This
attribute is only updated during logon if the old value is at least 14
(by
default) days in the past, but the value is replicated. You only need to
query one DC (any DC). The value is accurate if it corresponds to a date
more than 14 days in the past.

Both attributes are Integer8, so they are 64-bit numbers representing
dates
in UTC as the number of 100-nanosecond intervals since 12:00 AM January
1,
1601. The 64-bit value must be converted to a date/time in the current
time
zone.

I believe you can use Joe Richards' oldcmp utility for this:

http://www.joeware.net/win/free/tools/oldcmp.htm

And I have a VBScript program to retrieve lastLogon for all users in the
domain linked here:

http://www.rlmueller.net/Last%20Logon.htm

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab -http://www.rlmueller.net
--

The login time/date is only replicated in windows 2003, in windows
2000 you need to query every DC and merge the results.

You might consider
http://www.tools4ever.com/products/utilities/reallastlogon/,
free trail with full functionality so will get your report.


I should have stated that the lastLogonTimeStamp attribute is only available
if the domain is at Windows 2003 functional level. It is replicated. The
lastLogon attribute is never replicated.

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--


.

Relevant Pages

  • Re: "Last logon time" & "Last time the account was authenticated by AD
    ... We have the requirement to identify the last time that account ... the updated Last logon time. ... corresponds to the value of the lastLogon attribute. ... You must query all DC's ...
    (microsoft.public.windows.server.active_directory)
  • Re: Disable all accounts who havent logged on prior to certain date
    ... Joe, is there a tool which works with lastlogon? ... So if you are in domain functional mode, ... care and want to hit every account that matches the query, ...
    (microsoft.public.windows.server.active_directory)
  • Re: "Last logon time" & "Last time the account was authenticated by AD
    ... We have the requirement to identify the last time that account ... corresponds to the value of the lastLogon attribute. ... You must query all DC's ... I believe you can use Joe Richards' oldcmp utility for this: ...
    (microsoft.public.windows.server.active_directory)
  • Re: Domain access time
    ... You can get info. on the last logon time, via the lastLogon ... however it's not replicated so you need to pull it off each DC ... Microsoft MVP - Windows Server - Directory Services ...
    (microsoft.public.windows.server.active_directory)
  • Re: users last-logon-timestamp
    ... Can the "lastlogon" script be edited to show accounts that have not logged on ... last-logon-timestamp from Active Directory Users and computers. ... level with mixed windows 2000 and windows 2003 DCs) ...
    (microsoft.public.windows.server.active_directory)
Loading