Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have been tasked with a security requirement to display the last time a user was logged into the server upon login on our Windows 2003 and 2008 servers. This would apply to local and AD accounts. What is the best way to accomplish this? There doesn't appear to be any built in mechanism to do this and the best idea that we have found was the possibility of using a script with BgInfo.

share|improve this question

4 Answers 4

up vote 3 down vote accepted

A workaround that would work on both Server 2003 and 2008 would be to use BGInfo from sysinternal with the getCurrentUserLastLoginTime.vbs script from slingfive.com. You'll probably want to make sure you protect the script and the bginfo executable to make sure nobody plays tricks with your last login information.

share|improve this answer
    
Yeah, this is what I thought, I just wanted to confirm that there wasn't an easier/better way first. –  duckworth May 8 '09 at 14:33

For Windows Server 2008: this article explains how to enable this feature.

This feature is only available after the Domain Functional Level has been increased to Windows Server 2008. That means that only W2K8 DCs exist in the AD domain and no WNT4, no W2K or W2K3 DCs. Even after increasing the DFL the feature is not available right away.

Change this Group Policy setting if you want to write the information into the directory at logon:

 Computer Configuration\Administrative Templates\Windows Components\Windows Logon Options\
 Display information about previous logons during user logon = ENABLED

Warning: For domain user accounts in Windows Server 2003, Windows 2000 native, or Windows 2000 mixed functional level domains, if you enable this setting, a warning message will appear that Windows could not retrieve the information and the user will not be able to log on. Therefore, you should not enable this policy setting if the domain is not at the Windows Server 2008 domain functional level.

share|improve this answer

If you only had server 2008 DC's , so you could raise the domain functional level to Windows Server 2008 there is a quick and easy group policy setting to do this.

Unfortunately, if you Server 2003 DC's you need to look at the 'lastLogonTimeStamp' attribute of the user account.

share|improve this answer

use gpedit.msc, go to

Computer Configuration\Administrative Templates\Windows Components\Windows Logon Options\

disable this Display information about previous logons during user logon

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.