Download TRUELAST.ZIP and unzip it. TRUELAST.EXE outputs the true last logon time a particular user logged onto the current or a specified domain. It searches all domain controllers and outputs only the most recent time.

When you type TRUELAST /? at a CMD.EXE prompt, you receive:

TRUELAST - (C) 2002 by Bill Stewart (                              Usage: TRUELAST username \[domainname\]                              For each domain controller in domainname, searches for the most                              recent logon for the specified usename. If domainname is not                              specified, the current domain is used. It then displays the                              information in the following format:                              Last logon for USER was from DOMAINCONTROLLER on TIME                              Note that this program requires Windows NT or later because it                              implements the NetServerEnum and NetUerGetInfo APIs, which are                              not available on Windows 95/98/Me.
When I typed truelast Jennifer, I received:

Last logon for Jennifer was from JSI001 on Thu Jan 19 2006 at 11:55 PM

NOTE: See How is the lastLogonTimeStamp attribute replicated in a Windows Server 2003 domain?

NOTE: See How do I retrieve the last log on date and time for a user, even if they were authenticated by different domain controllers?