I'm sitting here across the office from Bob, who is logged into the domain right now, working away. I pull up AD Admin Center and take a look at Bob's account and it tells me his last log on date is 10/25/2010 at noon. It's currently 11/2/2010 at 10 in the morning.

My date on my server is correct, the date on his computer is correct...What's going on?

  • 3
    Do you have more than one domain controller? What versions are they if so? – Chris S Nov 2 '10 at 17:27
  • I don't know why people are voting to close, this fits perfectly on SF. – ThatGraemeGuy Nov 4 '10 at 11:34

Has he left his computer logged in since 10/25? Some people just lock their screens at nice for weeks at a time until a Windows update forces reboot.

Have Bob log off and log back on and see if it's updated.

  • That's genius, I never even thought of that. Thanks man – blsub6 Nov 2 '10 at 17:30

There are two attributes in Active Directory for Last Login tracking
lastLogon and `lastLogonTimestamp'.

The first (lastLogon) is a per Domain controller attribute that can take up to two weeks to sync to all other DC's due to low priority sync.

When synced it updates 'lastLogonTimestamp' which is the one shared by all DC's. I imagine that the AD Admin Center is looking at lastLogonTimestamp instead of the per DC value, since it would have to query all DC's, get the value, compare to find the latest and present it.


lastLogon is a per-DC property. It is not replicated, and exists in Windows 2000 AD and later. This is the last time that that account (user or computer) has checked into that particular DC

lastLogonTimeStamp is a account property which is replicated between DCs, but can (by default) be up to 14 days off. This property was introduced in Windows Server 2003 AD.

If I'm looking for stale accounts in the enterprise, I query for a lastLogonTimeStamp of 75 days or more ago (when I've achieved consensus that accounts over 60 days unused are "stale").

If I need to know the exact time somebody logged into the domain, you have to query each and every DC for the lastLogon property and use the latest date.

  • Good to know! I guess I assumed there was a single DC when I shouldn't have. – Aaron Copley Nov 4 '10 at 14:39
  • @Aaron Copley - As a side note, your assumption that there was only one DC makes me assume that you may only have a single DC. If that's the case, that's a bad position to be in. Stand up another one ASAP and be sure to make it a Global Catalog. (...but if that's not the case, disregard this entire comment!) – gWaldo Nov 4 '10 at 20:45
  • I don't run the DC's here but we do have more than one. What I meant is that I just wasn't thinking in terms of replication. :) – Aaron Copley Nov 4 '10 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.