Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a list of service accounts that I'm not familiar with. I'm trying to find out the last time anything has authenticated with this account before I disable or remove it. Is there a way to do this in Active Directory?

share|improve this question
    
which version of windows server are you running? –  RomeNYRR Mar 27 '12 at 19:26
    
I'm on Server 2003 –  m1kc Mar 27 '12 at 20:05
    
If the LastLogonTimeStamp is more than two weeks old, you can rely on that as the most recent logon. If an account logs on and the LastLogonTimeStamp is more than two weeks old, the domain controller replicates that attribute to other domain controllers within the usual time frame (within a site, right away; adjacent sites about 15 minutes). –  Greg Askew Mar 28 '12 at 18:48

3 Answers 3

The closest you'll get is the "lastLogonTimestamp" on the object. To figure out where it's logging in from, you'll have to parse the Domain Controller Security event-logs to look for the login event and where it came from.

share|improve this answer
    
hopefully he's at the correct domain level since in earlier versions of AD lastlogintimestamp was not replicated. –  tony roth Mar 27 '12 at 19:34
1  
In that case he'll have to check that value on every domain controller. It's work, but doable. –  sysadmin1138 Mar 27 '12 at 19:38
    
yep, just making sure he understood this. –  tony roth Mar 27 '12 at 19:58

With Powershell you can put the list of users in a file called users.txt and try this:

    get-content d:\data\users.txt |get-aduser -properties lastlogontimestamp |foreach {
   $ll = Get-Date -Date ([DateTime]::FromFileTime([Int64]::Parse($_.lastlogontimestamp))) -Format MM/dd/yyyy
   write-host $_.name, $ll
   }
share|improve this answer

And in case you're looking for other ways to query the lastLogonTimeStamp attribute, there is a command line tool called CSVDE (CSV Directory Export) that comes in handy. The following command will output all Active Directory users and their attributes to a CSV file. The command has parameters that also lets you filter and choose specific attributes to export.

csvde -f Users.csv -r "(ObjectClass=User)"
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.