Re: "Last logon time" & "Last time the account was authenticated b

Hi All,

Thank you for responses. I do have a script that extracts last logon details
of all the users in the domain. It quires all the domain controller and get
the update value.

My question is, Is the "Last logon time" & "Last time the account was
authenticated" the same?

Example:

"User A" is logged on the computer and trying to access one of the
application or any resource using "User B" account. Will the last logon time
stamp change for User B?

"Richard Mueller [MVP]" wrote:


"Tjeerd Seinen" <t.seinen@xxxxxxxxxxxxxx> wrote in message
news:1188486635.507550.5320@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
On Aug 30, 4:23 pm, "Richard Mueller [MVP]" <rlmueller-
nos...@xxxxxxxxxxxxxxxxxxxx> wrote:
sekhar wrote:
Environment: Windows 200

Are "Last logon time" and "Last time the account was authenticated by
AD"
the same? We have the requirement to identify the last time that
account
was
used or accessed.

Currently I am generating a report that will query all the DCs and will
get
the updated Last logon time. But this is not always correct?

"Last logon time" & "Last time the account was authenticated by AD" the
same?

Yes, the last time an account authenticated in AD will be the date/time
that
corresponds to the value of the lastLogon attribute. Just remember that
the
lastLogon attribute is not replicated. For any user or computer object a
different value is saved on every Domain Controller. You must query all
DC's
in the domain to get the largest (latest) value.

For most purposes, the lastLogonTimeStamp attribute will suffice. This
attribute is only updated during logon if the old value is at least 14
(by
default) days in the past, but the value is replicated. You only need to
query one DC (any DC). The value is accurate if it corresponds to a date
more than 14 days in the past.

Both attributes are Integer8, so they are 64-bit numbers representing
dates
in UTC as the number of 100-nanosecond intervals since 12:00 AM January
1,
1601. The 64-bit value must be converted to a date/time in the current
time
zone.

I believe you can use Joe Richards' oldcmp utility for this:

http://www.joeware.net/win/free/tools/oldcmp.htm

And I have a VBScript program to retrieve lastLogon for all users in the
domain linked here:

http://www.rlmueller.net/Last%20Logon.htm

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab -http://www.rlmueller.net
--

The login time/date is only replicated in windows 2003, in windows
2000 you need to query every DC and merge the results.

You might consider
http://www.tools4ever.com/products/utilities/reallastlogon/,
free trail with full functionality so will get your report.


I should have stated that the lastLogonTimeStamp attribute is only available
if the domain is at Windows 2003 functional level. It is replicated. The
lastLogon attribute is never replicated.

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--




Hi All,

Thank you for responses. I do have a script that extracts last logon details
of all the users in the domain. It quires all the domain controller and get
the update value.

My question is, Is the "Last logon time" & "Last time the account was
authenticated" the same?

Example:

"User A" is logged on the computer and trying to access one of the
application or any resource using "User B" account. Will the last logon time
stamp change for User B?

.

Relevant Pages

  • Re: Users last logon info from logon script
    ... I put this line in the users logon script: ... If I run the script manually, it shows the last logon time. ... I guess it is because Windows update the lastlogon attribute once a user ... Then, for each Domain Controller, ADO is used to search the ...
    (microsoft.public.security)
  • Re: Log file!
    ... Here is an example VBScript program to retrieve the lastLogon values for all ... logon and logoff info, you can assign Logon and Logoff scripts using Group ... This script appends a line to a log file in a shared location. ...
    (microsoft.public.windows.server.active_directory)
  • Re: List users that last logon was 180 days ago
    ... domain, where the users never have done logon, and another script that ... the users that theis last logon was 180 days ago ... ' Output latest lastLogon date for each user. ... If (dtmDate = #1/1/1601#) Then ...
    (microsoft.public.windows.server.scripting)
  • Re: error in start menu shortcut script
    ... to believe the directory was not available at logon time, as the script ... but putting shortcuts to the desktop folder instead of programs folder, ...
    (microsoft.public.scripting.wsh)
  • Re: Count Domain User Logon
    ... Richard's script gives you the lastLogon date for all users in the domain. ... interactive logon and kerb ticket, ...
    (microsoft.public.windows.server.active_directory)