Re: Days Since Last Login IN ADUC Query

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Thanks again for your response Richard! I have tried using the command
dsquery user -inactive 2. This returns a list of users, however it appears
to only return users who have logged on since the DFL and FFL were raised. I
know that there are users who have not logged on for months (if not years)
who are not in the list. Is there a way of identifying them or forcing the
value to update?

Thanks again!!!

"Richard Mueller [MVP]" wrote:

I think it's too late to change the defaults, since your are past the 14
days. If I understand how it works, the values will be updated from now on
as each user logs on. Remember that the values are only accurate within 14
days. For example, if you see a value 5 days in the past, the user could
have logged on many times since. If you see a value 20 days in the past, you
know the user has not logged in the past 6 days at least, maybe more.

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--

"NewToTechnet" <NewToTechnet@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:3A4C9877-99EF-4BCD-A445-57047D030C02@xxxxxxxxxxxxxxxx
Richard,

Many thanks for your responce. It really is greatly appreciated!

I have just checked when the DFL and FFL were raised, and it has been 16
days. Should I try again in a few days or is there somthing I can do to
force this to take place.

Thanks again for your response!!!!

"Richard Mueller [MVP]" wrote:

When the domain is first raised to the required functional level, the
lastLogonTimeStamp attribute is randomly updated for users as they logon
over a period of about 14 days. This is to reduce replication traffic if
everyone logs in on day one. Normally, after two weeks a value of 0 means
the user has never logged on. However, you cannot count on any user
having a
value unless they have logged in after the initial 14 days. Thereafter,
the
value is updated at logon only if the old value is more than 14 days old.

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--

"NewToTechnet" <NewToTechnet@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:5AD7E30D-8545-4903-B39F-9AF5FF22E253@xxxxxxxxxxxxxxxx
Thanks Richard. I did say I did not want to use Third Part Tools
though....However with not being able to gather the necessary without
soing
so I tried this anyway. The results gives me a Last Login Time Stamp
of
0000/00/00-00:00:00. This might explain why it is not working in ADUC,
however I do not understand why the Last Login Time Stamp is
"0000/00/00-00:00:00".

Any ideas?

Thanks

"Richard Mueller [MVP]" wrote:

NewToTechnet wrote:

I have searched the internet for a solution to this problem however
the
only
answer appears to be to use a script or some third party software,
which I
would rather not do as I believe that from following the steps below
I
should
dbe able to retreive the information I require.

We are an Window 2003 Active Directory Domain (Native, having
upgraded
the
Domain Functional Level just over 2 weeks ago)

We have a number of users accounts that have definatly not been
useed
for
at
least 30 days (years in some cases) and so I want to identify these
in
one
simple operation.

I have created a query at the Root of the domain (and in varios OU's
and
containers) in ADUC Queries, used a Common Query, and selected the
"Days
Since Last Logon" as 30. I have also tried leaving the "Name" field
blank
as
well as "Has a value", however when I select ok I receive the
following
in
the "Query String" dox " The query is valid but will not be shown
here
because it contains values that must be computed when the query is
run".
I
get this message if I select the "Days Since Last Logon" in any of
my
queries. All other quesries work.

Does anyone know how to make this query work.

I have tried refreshing the page etc.

If this is a bug and the query does not work, does anyone know the
syntax
to
retrive the information using dsquery.

Thanks in advance



I don't know why the saved query doesn't work, but you can use Joe
Richards'
free oldcmp utility. It works on both computer and user accounts:

http://www.joeware.net/freetools/tools/oldcmp/index.htm

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--









.

Relevant Pages

  • Re: LDAP Query for Expired accounts
    ... Thanks Richard! ... > Also, in testing the script below, I found that my ldap query is ... > Distinguished Names of all expired user accounts follows. ... > Dim objShell, lngBiasKey, lngBias, k ...
    (microsoft.public.windows.server.active_directory)
  • Re: Multiple combo boxes - send parameters to a query?
    ... Marshall and Richard, ... IF the fields you are applying criteria ... will not be returned by the query. ... >>Hi Marshall - I think I might have solved this problem. ...
    (microsoft.public.access.queries)
  • Re: Exclude OU from LDAP query
    ... Yeah, as Richard indicated, dn won't work but then nothing will work to do what you want... ... You can't filter out branches of the tree in a query. ... distinguishedName, and similar attributes. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Days Since Last Login IN ADUC Query
    ... Thanks Richard. ... containers) in ADUC Queries, used a Common Query, and selected the "Days ... Since Last Logon" as 30. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Days Since Last Login IN ADUC Query
    ... When the domain is first raised to the required functional level, ... value is updated at logon only if the old value is more than 14 days old. ... Microsoft MVP Scripting and ADSI ... I have created a query at the Root of the domain (and in varios OU's ...
    (microsoft.public.windows.server.active_directory)