CODEWITHSUNDEEP
attributesactive-directory
Sandra
Sandra

Reputation: 708

Active Directory LastLogonTimeStamp Attribute is Way Off

I produced a report identifying stale accounts older than 60 days. For this time frame, I figured it is fine to use the LastLogonTimeStamp value from one DC. Even with the 9-14 day accuracy caveat, it serves the purpose.

The problem is, someone identified one account that didn't seem right. LastLogonTimeStamp for this account contained a date in July 2011. The user has not been with the company since 2010.

To resolve the discrepancy, I queried each and every DC for the LastLogon attribute. ALL of them are either Never, or they are in 2010.

I also queried each DC for LastLogonTimeStamp, and they are all identical, reporting the July 2011 date. LastLogonTimeStamp is correct for the vast majority of users, so there isn't an underlying replication issue.

So where on earth is this LastLogonTimeStamp coming from, and how can it be so wrong?

Any ideas?

Thanks much, Sandra

Upvotes: 0

Views: 7454

Answers (3)

Kevin M
Kevin M

Reputation: 5506

LastLogonTimeStamp is the replicable attribute but this attribute is not updated every time a user successfully logs in. This attribute is updated only when its current value is older than the current time minus the value of the msDS-LogonTimeSyncInterval attribute.

Upvotes: 0

ixe013
ixe013

Reputation: 10181

From The LastLogonTimeStamp Attribute – What it was designed for and how it works

The intended purpose of the lastLogontimeStamp attribute to help identify inactive computer and user accounts. The lastLogon attribute is not designed to provide real time logon information. With default settings in place the lastLogontimeStamp will be 9-14 days behind the current date.

Upvotes: 0

Marlin Gubser
Marlin Gubser

Reputation: 11

Note that the LastLogon and LastLogonTimestamp attributes are not updated using the same logon criteria (i.e. logon types). See http://support.microsoft.com/default.aspx?scid=kb;EN-US;939899 which explains specifically why they may be different.

Upvotes: 1

Related Questions