1

I am trying to determine the last time a active directory user was logged in by doing a ldap query and using the property lastLogon. This code runs on two web servers. Each server is connecting to a different domain controller. The last login date and time from each web server is different. Why is this and how can I get the most accurate lst login date and time?

0

LastLogon is not replicated. Either you need to use LastLogonTimestamp, or query all domain controllers for the most recent logon.

LastLogonTimestamp is not replicated every time either. It's only replicated if it is older than ~14 days, plus or minus a few days.

It can be reduced by using ADSIEdit.msc. Domain Naming Context, msDS-LogonTimeSyncInterval attribute.

LastLogonTimestamp

More information:

https://docs.microsoft.com/en-us/windows/win32/adschema/a-msds-logontimesyncinterval

https://adsecurity.org/?p=380

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.