Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there a way to determine by querying Active Directory when a computer was running? I want a quick way to exclude computers in the domain that have been off for (say) 7 days. The LastLogonTime fields don't help as this isn't anything to do with user's logging on.

share|improve this question

2 Answers 2

up vote 9 down vote accepted

No there isn't a good way of knowing when a computer was last powered on using only information stored in Active Directory. The LastLogonTimestamp of a computer object is updated by the computer, so I'm not sure what you mean by your last sentence. But it's going to be 9 - 14 days off regardless. That attribute is not updated every time a computer logs on to the domain. This is the attribute that

dsquery computer -inactive 24

is looking at. The granularity is in weeks because of the inherent lack of precision of lastLogonTimestamp.

You can reconfigure AD to update the lastLogonTimestamp attribute more often, which would result in a slightly more accurate value, but this is still not going to help you account for computers that were powered on but not connected to the network, or if you need accuracy down to like within less than a day.

http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx

Consider doing something like a script that runs on each computer, and queries the Win32_OperatingSystem WMI class. The computer's precise last bootup time is stored in that WMI class.

Get-WMIObject -Query "SELECT LastBootUpTime From Win32_OperatingSystem" -ComputerName PC02

share|improve this answer
    
+1 -- but to get to the root of what Rob might be after, use JoeWare's oldcmp. Easy, quick, done. I personally wouldn't care about anything under 60 days. 7 is really too soon... –  TheCleaner Feb 19 at 13:55
    
Sorry my statement about LastLogonTime was before I fully appreciated the field - it's not just the last time a user logged on - other activities cause it to be updated –  Rob Nicholson Feb 20 at 14:30
    
Thanks all for confirming there is no good way to do this. A bit of a surprise - I would have through an update of a heartbeat type property in AD periodically (say every hour) wouldn't have caused too much AD replication overhead - compared to the amount DFS-R traffic we have going on, AD replication is a mere blip –  Rob Nicholson Feb 20 at 14:33
    
We may consider writing a little service that's installed on every computer to do this –  Rob Nicholson Feb 20 at 14:33

Although I concur with Ryan's answer that there's no good way of doing this with information stored in Active Directory (by default)...

If you absolutely must have something in Active Directory, the best way to do this is to set a machine startup script (deployed via GPO) to alter one of the attributes of the computer object. Appending a timestamp to the description attribute is a classic, but there are lots of generally unused attributes (department, departmentNumber, employeeID, employeeNumber, etc.) if you're looking for one to use and don't want to append to the description attribute.

Alternately, I've seen this type of thing achieved by dumping machine information in a text or .csv file (including boot time) to a share Everyone has write access to, that administrators then parse with scripts and/or eyeballs. I prefer the AD attribute approach, but both are valid.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.