Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am developing a script to report on users who have not logged in to the domain for 6 months. I'm using lastLogonTimestamp as within 14 days is precise enough for my purposes, and I don't want to have to query each DC.

The problem is, when I run the script, the lastLogonTimestamp comes back blank for nearly 600 users. But, and here's the weird bit, I can then do Get-ADUser (which is what is used within the script to retrieve this information) for one of these users at the same prompt and it gives me a value.

What could be causing this?

UPDATE: Just to provide some clarification. Yes the DFL is 2003. Also, to clarify. I'm only referring to the lastLogonTimestamp attribute, not any other attribute.

The script begins by creating an object containing every user:

$userlist = Get-ADUser -Filter * -properties lastLogonTimestamp

Aside from some other logic, I write out each user to a text file by using a foreach ($user in $userlist) loop. Effectively

$name = $user.Name
$llts = $user.lastLogonTimestamp

When I review the text file, the lastLogonTimestamp is blank for nearly 600 users. Of some of these, I pick a test subject, for example someone who I know has logged on recently, let's say user-x. User-x will have lastLogonTimestamp blank in the text file. If, however, I then run

Get-ADUser user-x -properties lastLogonTimestamp

on the same command line after the script has completed for user-x, it returns a value for lastLogonTimestamp.

UPDATE 2: This makes no sense! I changed the script to pull the lastLogonTimestamp property in the loop rather than when I create the userlist object:

foreach ($user in $userlist)
{
$SamAccountName = $user.SamAccountName
$thisUser = Get-ADUser $SamAccountName -properties lastLogonTimeStamp

...
}

I thought this would more closely replicate what I'm using at the command line when it pulls the property successfully, but it still doesn't work. It's probably worth pointing out it's the same users every time.

share|improve this question
    
Can you post the script you are using? –  Mike Mar 7 '12 at 23:29
    
Yeah, I deleted my answer because it did not answer your question. I'm not able to reproduce the issue you're seeing using your exact steps. Sorry. :( –  Ryan Ries Mar 8 '12 at 1:49
    
No worries thank you anyway –  Matt Mar 8 '12 at 2:40
    
Is there a specific reason you don't want to query all the DCs? It's the only way you're going to get all of the information for every user. LastLogontimestamp data isn't necessary stored on every dc for every user. The reason some commands return that data is that they are built with that caveat in mind. –  Tatas Mar 16 '12 at 19:24
1  
@Tatas The lastLogonTimestamp attribute does replicate to all DCs, just not very quickly. Any user who has logged in at least once more than 14 days ago should have a value in this attribute. At least, that is my understanding from reading the docs. –  pipTheGeek Mar 16 '12 at 19:33

2 Answers 2

The problem is with this statement in your Update 2

$SamAccountName = $user.SamAccountName

is that after you do this, the object type of $SamAccountName is System.String so you've lost the AD user context.
Try this:

get-aduser -filter * -properties lastLogonTimestamp | select name, lastLogonTimestamp |export-csv "output.csv"

For your previous code, the issue appears to be with other variable handling. A more substantial snippet will help us give a better answer

share|improve this answer
1  
Yes our DFL is at 2003 –  Matt Mar 8 '12 at 2:40
    
My answer is updated –  uSlackr Mar 8 '12 at 13:58
    
Thanks for the info, the script sample in update 2 was a typo, I've corrected it now. –  Matt Mar 11 '12 at 20:58

Are you looping through all your domain controllers to get the true last logon time? This property and value is not synchronized across DCs IIRC. This is the function we use in our environment to retrieve the correct value for a single user:

function func_ad.getLastLogon
{
param(
[string]$username
)

$dcs = Get-ADDomainController -Filter {Name -like "*"}
$time = 0
foreach($dc in $dcs)
{ 
    $hostname = $dc.HostName
    $userResult = Get-ADUser -Identity $username -properties lastLogon
    if($userResult.LastLogon -gt $time) 
    {
        $time = $userResult.LastLogon
    }
}
$dt = [DateTime]::FromFileTime($time)
return $dt
}

In your case, to avoid unnecessary duplication I'd place Get-ADDomainController outside the function, but pass the array of DCs to the function along with the username. You could even modify the $username param to accept an array....

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.