Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to artificially change the "lastLogon" and/or "lastLogonTimestamp" for a user?

I have a script that disables and/or deletes old users and I want to make sure it is getting the dates correctly with test users before I put it into production.

I have tried using an LDAP tool, but I am seemingly not allowed to alter that user property - I get the error "Unwilling to perform".

All suggestions are welcome.

share|improve this question
up vote 2 down vote accepted

you can accomplish that using adsi edit, it's a very powerful tool, so be careful.

  • start->run->"adsiedit.msc"
    if you get "command not found" this should help
  • browse to the user
  • right click, properties
  • there you are :)
share|improve this answer

There is also a sysinternals app called ADExplorer that you might want to check out.

Download here -

Once you connect to your domain, you can browse down to the user and see the specific attributes. Then right click and Modify the selected attribute.

share|improve this answer

Note that lastLogonTimestamp is not replicated - each DC holds its own value. To get a true picture of a person's last logon, you'll need to gather the value from each DC and determine which is the latest.

share|improve this answer
The lastLogonTimestamp is replicated, perhaps not at the frequency one might expect, it's the lastLogon attribute that is not replicated. I think your answer may have been better suited as a comment. – jscott Nov 8 '10 at 18:49
OK, not reliably replicated. You can't make account status changes based on one DC's value. Been there. Plus, you need to account for occasions when a DC will randomly return a NULL. Haven't got to the bottom of this one yet (Win2k3 SP2 R2). – Simon Catlin Nov 8 '10 at 20:11
There is only one domain controller, so in this case I will be "safe" :) – Christian P. Nov 9 '10 at 9:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.