Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there any way to artificially change the "lastLogon" and/or "lastLogonTimestamp" for a user?

I have a script that disables and/or deletes old users and I want to make sure it is getting the dates correctly with test users before I put it into production.

I have tried using an LDAP tool, but I am seemingly not allowed to alter that user property - I get the error "Unwilling to perform".

All suggestions are welcome.

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

you can accomplish that using adsi edit, it's a very powerful tool, so be careful.

  • start->run->"adsiedit.msc"
    if you get "command not found" this should help
  • browse to the user
  • right click, properties
  • there you are :)
share|improve this answer
add comment

There is also a sysinternals app called ADExplorer that you might want to check out.

Download here - http://technet.microsoft.com/en-us/sysinternals/bb963907.aspx

Once you connect to your domain, you can browse down to the user and see the specific attributes. Then right click and Modify the selected attribute.

share|improve this answer
add comment

Note that lastLogonTimestamp is not replicated - each DC holds its own value. To get a true picture of a person's last logon, you'll need to gather the value from each DC and determine which is the latest.

share|improve this answer
    
The lastLogonTimestamp is replicated, perhaps not at the frequency one might expect, it's the lastLogon attribute that is not replicated. I think your answer may have been better suited as a comment. –  jscott Nov 8 '10 at 18:49
    
OK, not reliably replicated. You can't make account status changes based on one DC's value. Been there. Plus, you need to account for occasions when a DC will randomly return a NULL. Haven't got to the bottom of this one yet (Win2k3 SP2 R2). –  Simon Catlin Nov 8 '10 at 20:11
    
There is only one domain controller, so in this case I will be "safe" :) –  Christian P. Nov 9 '10 at 9:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.