Finding a User’s Last Logon

For various reasons, you might need to determine when a user last logged on to the domain. On occasion, my company's management has asked me to find this information, which isn’t available from the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in. Recognizing this limitation, Microsoft created Acctinfo.dll to extend the Active Directory Users and Computers snap-in to display more Active Directory (AD) attributes. If you register Acctinfo.dll and have a Windows Server 2003 domain running in Windows 2003 forest functional mode, you can use the snap-in to view the lastLogonTimestamp attribute. However, the lastLogonTimestamp attribute isn't designed to provide 100 percent accuracy; it can be inaccurate by up to a week. Dissatisfied with this limitation, I wrote a script to get exact information. Before I describe the script and how it works, however, let me review how AD stores last logon information.

When you log on to an AD domain, the domain controller (DC) that authenticates your logon stores the date and time of your logon in the lastLogon attribute—but the lastLogon attribute isn't replicated between DCs. For Windows 2003 domains running in Windows 2003 forest functional mode, Microsoft introduced the lastLogonTimestamp attribute, which records an account’s most recent logon. However, to avoid high replication traffic, the attribute isn’t replicated if the last logon occurred less than a week previously. . . .