LastLogonTimeStamp

[Moldy_Kebab]

I have writen a script to audit users on my estate I have a 2003
domain and want to return the lastlogon times I would prefer to use
the "LastLogonTimeStamp" over "lastlogon" as I would prefer not to
have to query each server.

My script failed and when I used adsiedit I found that
"LastLogonTimeStamp" was <not set>.

Is there some configuration I must complete to populate this? Could
this be a side effect of upgrading my domain from a 2000 domain?

TIA Rob

[Torgeir Bakken (MVP)]

Moldy_Kebab wrote:
> I have written a script to audit users on my estate. I have a 2003

> domain and want to return the lastlogon times I would prefer to use
> the "LastLogonTimeStamp" over "lastlogon" as I would prefer not to
> have to query each server.
>
> My script failed and when I used adsiedit I found that
> "LastLogonTimeStamp" was <not set>.
>
> Is there some configuration I must complete to populate this? Could
> this be a side effect of upgrading my domain from a 2000 domain?

Hi

From the docs:

http://www.microsoft.com/resources/documentation/WindowsServ/2003/enterprise/proddocs/en-us/dsadmin_concepts_accounts.asp

<quote>
When the domain functional level has been set to Windows Server 2003,
a new lastLogonTimestamp attribute is used to track the last logon
time of a user or computer account.
</quote>

http://msdn.microsoft.com/library/en-us/adschema/ad/adam_a_lastlogontimestamp.asp

<quote>
Last-Logon-Timestamp
This is the time that the user last logged into the domain. This value
is only updated when the user logs in if a week has passed since the
last update. This value is replicated.
</quote>

The above is relevant for both user and computer accounts. Note the
once a week update only part and the Windows Server 2003 domain
functional level prerequisite.

Raise the domain functional level; Windows Server 2003
http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/sag_changedomlevel.asp

Raising the Roof on Domain Functional Levels
http://www.networking.earthweb.com/netos/article.php/3298531

--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx

[Joe Richards [MVP]]

You need to be in Domain Functional mode.

Note that the lastLogonTimeStamp will not indicate the LAST time the user logged
on and will not get updated every time they logon, it only updates once every 7
or 10 days (I don't recall the default).

joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net

Moldy_Kebab wrote:
> I have written a script to audit users on my estate. I have a 2003
> domain and want to return the lastlogon times I would prefer to use
> the "LastLogonTimeStamp" over "lastlogon" as I would prefer not to
> have to query each server.
>
> My script failed and when I used adsiedit I found that
> "LastLogonTimeStamp" was <not set>.
>
> Is there some configuration I must complete to populate this? Could
> this be a side effect of upgrading my domain from a 2000 domain?
>

> TIA Rob

[Torgeir Bakken (MVP)]

Joe Richards [MVP] wrote:

> You need to be in Domain Functional mode.
>
> Note that the lastLogonTimeStamp will not indicate the LAST time the
> user logged on and will not get updated every time they logon, it only
> updates once every 7 or 10 days (I don't recall the default).

Hi

The quotes from the MS documentation in my other post in this tread
states 7 days...

[Joe Richards [MVP]]

Thanks I knew it was either 7 or 10, can never recall the default as I have
changed the frequency in my test domain so many times.

joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net