Determining When a User Last Logged On

Q: How can I find a user’s last logon time in a Windows domain? Where is a user’s last logon time stored in Active Directory (AD)?

A: AD stores a user’s last logon time in the Last-Logon AD user object attribute. As with the logging of account logon events, the last logon time is updated only in the AD instance of the domain controller (DC) that actually authenticated the user, meaning you must query all the DCs in the domain in which the user’s account is defined to find his last logon time.

Microsoft included a new AD user object attribute called Last-Logon- TimeStamp in Windows Server 2003. The Last-Logon-TimeStamp attribute stores the approximate value of the last logon time of a user. The value is approximate because AD replicates the Last-Logon-TimeStamp attribute only once every 14 days to avoid replication overhead. Although the Last-Logon- TimeStamp doesn’t resolve the problem that you must query all DCs in the user’s domain if you want to know the exact last logon time, it does give administrators a way to discover inactive or stale accounts. The Last-Logon-TimeStamp attribute is activated only when the domain is switched to the Windows 2003 domain functional level. For more information about Last-Logon-TimeStamp and to download sample scripts to query the value of the Last-Logon-TimeStamp attribute of a given user, go to www.microsoft.com/technet/scriptcenter/topics/win2003/lastlogon.mspx.

You can also view the value of Last- Logon-TimeStamp for a given user from the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in if you install a special DLL called acctinfo.dll. This DLL is included in the Account Lockout and Management Tools, which can be downloaded from www.microsoft.com/downloads/details.aspx?FamilyID=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en. Acctinfo.dll adds the Additional Account Info tab to an AD user account’s properties, as shown in Figure 1. The Additional Account Info tab contains different types of account logon and logoff information, including the value of the Last-Logon- TimeStamp attribute.

—Jan De Clercq