Re: Attributes that Update during Computer logon

Thanks again for your responses and assistance.

Basically we want to be able to put these users and computers in the domain
but they are never at our offices or sites; they only connect remotely.
Ultimately their computer accounts will become stale and will be deleted as
you mentioned which is what we are trying to avoid. We have figured out a
solution for applying GPOs and reseting their User account passwords when
they expire (all through our VPN) but the Computer accounts are still a
problem. I was hoping to update the directory manually to avoid this issue
but if that is not possible do you have any other suggestions? We have
considered using dial-up networking in where Windows would connect to the VPN
prior to logon but the learning curve for our users is what may be difficult
so we are attempting to pursue all options.

Would greatly appreciate any feedback on this.

Thanks
Ray

"Richard Mueller [MVP]" wrote:


"RayRay" <RayRay@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A0B78B22-B563-4B94-8D90-2B5D2F66FA26@xxxxxxxxxxxxxxxx
Thank you very much for your response. 3 additional questions.
You mention that the computer may request its password to be reset, will
the
object request this automatically based on the 14 days password policy and
how much time is left before expiring?

The client OS requests the password reset automatically as the computer
authenticates to the domain. It only requests after the password has
expired.


Also, in reviewing the attributes for a Computer object (using a LDAP
browser) I noticed multiple attributes named "dsCorePropagationData" that
appear to be dates as well. Any idea what these are and if I would need
to
update them to simulate a logon? Microsoft lists it as "Internal Use
only."

I don't know what dsCorePropagationData is used for. I just know it is not
replicated, is in the GC, and is generalizedTime (which is different from
Integer8 attributes). When I look at the dates I don't believe it is updated
at every logon. I know I have logged on many on many days that are not
included in the collection for my computer.


Finally you mentioned that "lastLogon" was not replicated but is the
"lastLogonTimestamp" attribute? If I am not mistaken "User" objects have
this same attribute and it is replicated every 14 days. Will the
"Computer"
objects "lastLogontimestamp" function the same way?

I should have mentioned lastLogonTimeStamp. Yes, it is only updated during
logon if the previous value is more than 14 days (by default) in the past.
Once updated, the value is replicated. It works the same for user and
computer objects.


You assistance is greatly appreciated.
Thanks
Ray


I don't think you can code a script or program that will update these
attributes. They are updated by the system. I guess I have to ask why you
want to, or what is your goal? The pwdLastSet attribute, for example, cannot
be assigned a value, and it should not matter anyway. A computer can be
roving disconnected for some time and it won't matter. The password will be
reset the next time it authenticates. The lastLogon attribute shouldn't
matter either. The only issue I can think of would be identifying "stale"
computer accounts to be disabled and eventually deleted.

--
Richard Mueller
MVP Directory Services
Hilltop Lab - http://www.rlmueller.net
--



.

Relevant Pages

  • Re: AD/E2K Last User Logon Question
    ... In Win2K, the lastlogon is not replicated among all the DCs, so you will get ... I have also just read that Hyena's Reporter will do the aggregation for you. ... > last logon date for each user account: ... > single AD and there is replication (which is not failing- ...
    (microsoft.public.exchange2000.active.directory.integration)
  • Re: Attributes that Update during Computer logon
    ... You mention that the computer may request its password to be reset, ... Finally you mentioned that "lastLogon" was not replicated but is the ... This attribute is also Integer8 and is replicated. ...
    (microsoft.public.windows.server.active_directory)
  • Re: OE6, identities, updates & SP2
    ... Force Identity Logon ... Mike - http://pages.prodigy.net/michael_santovec/techhelp.htm "Greg" wrote in message ... anytime I logged onto OE (without rebooting)> the previously selected identity opened without a request for an identity. ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
  • Re: OE6, identities, updates & SP2
    ... As you first suggested, I setup 5 new identities, ... the previously selected identity opened without a request for an identity. ... request for an identity the next time I logon (without rebooting). ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
  • Re: "Last logon time" & "Last time the account was authenticated b
    ... I do have a script that extracts last logon details ... the updated Last logon time. ... corresponds to the value of the lastLogon attribute. ...
    (microsoft.public.windows.server.active_directory)