lastLogontimeStamp (what you are querying) is not updated on every logon, but is replicated to other domain controllers. By default it can be as much as 14 days out of date.
What is difference between lastLogon and lastLogontimeStamp?
LastLogon reflects the last interactive logon that was authenticated by a specific domain controller. The value is not replicated to other domain controllers. LastLogonTimestamp reflects many other types of logons: Interactive, Network and Service logons.
What triggers an update of lastLogontimeStamp?
Also, Interactive, Network, and Service logons will update the lastLogontimeStamp. So if a user logs on interactively, browses a network share, access the email server or runs an LDAP query, the lastLogontimeStamp attribute will updated if the right condition is met.
What is last logon timestamp?
This is the time that the user last logged into the domain. This value is stored as a large integer that represents the number of 100-nanosecond intervals since January 1, 1601 (UTC). Whenever a user logs on, the value of this attribute is read from the DC.
How can I tell the last time a user logged in Active Directory?
Step 1: Open Active Directory Users and Computers and make sure Advanced features is turned on. Step 2: Browse and open the user account. Step 3: Click on Attribute Editor. Step 4: Scroll down to view the last Logon time.
How do I get LastLogontimestamp?
Find All AD Users Last Logon Time Using PowerShell
- Open your notepad and add the following codes:
- Click on the Save as option to save the file.
- Type a name for the script as lastlogon.ps1.
- Click on the Save button to save the file.
What is Lastlogon in Active Directory?
The Active Directory attribute lastLogon shows the exact timestamp of the user’s last successful domain authentication on the regarding domain controller. It doesn’t matter here how the user performed this logon operation – interactive, network, passed-through from a radius service or another kerberos realm.
What is last logon date in Active Directory?
Each time a user logs on, the value of the Last-Logon-Timestamp attribute is fixed by the domain controller. With the last login date at hand, IT admins can readily identify inactive accounts and then disable them, thereby minimizing the risk of unauthorized attempts to log into the organization’s IT systems.
What’s the difference between lastlogon and lastlogontimestamp?
LastLogonDate is a converted version of LastLogontimestamp. He was technically right. It’s not a replicated attribute. Instead, it’s a locally calculated value of the replicated value. Most importantly, it gives us the ability to query using human friendly date formats!!
Why is the lastlogontimestamp attribute not replicated?
Because it is only updated on one DC, that means this attribute is not replicated. While that might seem inconvenient at first, this is actually a pretty useful function. In those cases when you may want to figure out what sites a user has logged on (or not logged on), you would use this attribute.
Is the lastlogon on the domain controller replicated?
Lastlogon is only updated on the domain controller that performs the authentication and is not replicated. LastLogontimestamp is replicated, but by default only if it is 14 days or more older than the previous value. To expand on this, LastLogonDate doesn’t actually exist in AD, it’s a conversion of LastLogonTimeStamp to date/time format.
How often is lastlogontimestamp replicated on all DCS?
Summary: lastLogonTimestamp is replicated on all DCs every 14 days – random of 5%, with an interactive logon, network and simple bind logons. This value should be used to find stale accounts. It’s a locally calculated value of the LastLogontimestamp attribute used by PowerShell.
