Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm sitting here across the office from Bob, who is logged into the domain right now, working away. I pull up AD Admin Center and take a look at Bob's account and it tells me his last log on date is 10/25/2010 at noon. It's currently 11/2/2010 at 10 in the morning.

My date on my server is correct, the date on his computer is correct...What's going on?

share|improve this question
3  
Do you have more than one domain controller? What versions are they if so? –  Chris S Nov 2 '10 at 17:27
    
I don't know why people are voting to close, this fits perfectly on SF. –  ThatGraemeGuy Nov 4 '10 at 11:34
add comment

3 Answers

up vote 10 down vote accepted

Has he left his computer logged in since 10/25? Some people just lock their screens at nice for weeks at a time until a Windows update forces reboot.

Have Bob log off and log back on and see if it's updated.

share|improve this answer
    
That's genius, I never even thought of that. Thanks man –  blsub6 Nov 2 '10 at 17:30
add comment

There are two attributes in Active Directory for Last Login tracking
lastLogon and `lastLogonTimestamp'.

The first (lastLogon) is a per Domain controller attribute that can take up to two weeks to sync to all other DC's due to low priority sync.

When synced it updates 'lastLogonTimestamp' which is the one shared by all DC's. I imagine that the AD Admin Center is looking at lastLogonTimestamp instead of the per DC value, since it would have to query all DC's, get the value, compare to find the latest and present it.

share|improve this answer
add comment

lastLogon is a per-DC property. It is not replicated, and exists in Windows 2000 AD and later. This is the last time that that account (user or computer) has checked into that particular DC

lastLogonTimeStamp is a account property which is replicated between DCs, but can be up to 14 days off. This property was introduced in Windows Server 2003 AD.

If I'm looking for stale accounts in the enterprise, I query for a lastLogonTimeStamp of 75 days or more ago (when I've achieved consensus that accounts over 60 days unused are "stale").

If I need to know the exact time somebody logged into the domain, you have to query each and every DC for the lastLogon property and use the latest date.

share|improve this answer
    
Good to know! I guess I assumed there was a single DC when I shouldn't have. –  Aaron Copley Nov 4 '10 at 14:39
    
@Aaron Copley - As a side note, your assumption that there was only one DC makes me assume that you may only have a single DC. If that's the case, that's a bad position to be in. Stand up another one ASAP and be sure to make it a Global Catalog. (...but if that's not the case, disregard this entire comment!) –  gWaldo Nov 4 '10 at 20:45
    
I don't run the DC's here but we do have more than one. What I meant is that I just wasn't thinking in terms of replication. :) –  Aaron Copley Nov 4 '10 at 20:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.