Q: How can I find a user’s last
logon time in a Windows domain?
Where is a user’s last logon time
stored in Active Directory (AD)?
A: AD stores a user’s last logon time in
the Last-Logon AD user object attribute.
As with the logging of account logon
events, the last logon time is updated
only in the AD instance of the domain
controller (DC) that actually authenticated
the user, meaning you must query
all the DCs in the domain in which the
user’s account is defined to find his last
logon time.
Microsoft included a new AD user
object attribute called Last-Logon-
TimeStamp in Windows Server 2003.
The Last-Logon-TimeStamp attribute
stores the approximate value of the
last logon time of a user. The value is
approximate because AD replicates the
Last-Logon-TimeStamp attribute only
once every 14 days to avoid replication
overhead. Although the Last-Logon-
TimeStamp doesn’t resolve the problem
that you must query all DCs in the user’s
domain if you want to know the exact
last logon time, it does give administrators
a way to discover inactive or stale
accounts. The Last-Logon-TimeStamp
attribute is activated only when the
domain is switched to the Windows
2003 domain functional level. For more
information about Last-Logon-TimeStamp
and to download sample scripts to query
the value of the Last-Logon-TimeStamp
attribute of a given user, go to www.microsoft.com/technet/scriptcenter/topics/win2003/lastlogon.mspx.
You can also view the value of Last-
Logon-TimeStamp for a given user from
the Microsoft Management Console
(MMC) Active Directory Users and Computers
snap-in if you install a special DLL
called acctinfo.dll. This DLL is included in
the Account Lockout and Management
Tools, which can be downloaded from
www.microsoft.com/downloads/details.aspx?FamilyID=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en.
Acctinfo.dll adds the Additional Account
Info tab to an AD user account’s properties,
as shown in Figure 1. The Additional
Account Info tab contains different types
of account logon and logoff information,
including the value of the Last-Logon-
TimeStamp attribute.
—Jan De Clercq