Computer Account - last logon

[acl03]

Is there a way, inherently, to find out the last time someone logged into the domain on a computer account? Maybe somewhere in adsideit.msc?



Thanks,
Andrew

 

[PScottC]

No. You have to query every DC in your environment and determine the latest date. If you search around this site and the internet you will find vbscripts that will perform this function.

If you can live with "close", you can query the lastLogonTimestamp attribute of the user account. This attribute is replicated to all DCs, but is only updated once every 7 days.

Oh... I almost forgot to mention... the lastLogon and lastLogonTimestamp attributes are stored in AD in Integer8 format. You can convert it using the W32Tm command or by vbscript.

For your second criteria, the computer on which the user logged in is not recorded. To get that information you need to query the event logs of every PC or write a logging feature into your login script that records which systems users are logging into.

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers