Querying AD for a service account's last authentication

Question

I have a list of service accounts that I'm not familiar with. I'm trying to find out the last time anything has authenticated with this account before I disable or remove it. Is there a way to do this in Active Directory?

Answer 1

The closest you'll get is the "lastLogonTimestamp" on the object. To figure out where it's logging in from, you'll have to parse the Domain Controller Security event-logs to look for the login event and where it came from.

Answer 2

With Powershell you can put the list of users in a file called users.txt and try this:

    get-content d:\data\users.txt |get-aduser -properties lastlogontimestamp |foreach {
   $ll = Get-Date -Date ([DateTime]::FromFileTime([Int64]::Parse($_.lastlogontimestamp))) -Format MM/dd/yyyy
   write-host $_.name, $ll
   }

Answer 3

And in case you're looking for other ways to query the lastLogonTimeStamp attribute, there is a command line tool called CSVDE (CSV Directory Export) that comes in handy. The following command will output all Active Directory users and their attributes to a CSV file. The command has parameters that also lets you filter and choose specific attributes to export.

csvde -f Users.csv -r "(ObjectClass=User)"