2

Is there any way to artificially change the "lastLogon" and/or "lastLogonTimestamp" for a user?

I have a script that disables and/or deletes old users and I want to make sure it is getting the dates correctly with test users before I put it into production.

I have tried using an LDAP tool, but I am seemingly not allowed to alter that user property - I get the error "Unwilling to perform".

All suggestions are welcome.

3 Answers 3

4

you can accomplish that using adsi edit, it's a very powerful tool, so be careful.

  • start->run->"adsiedit.msc"
    if you get "command not found" this should help
  • browse to the user
  • right click, properties
  • there you are :)
2

There is also a sysinternals app called ADExplorer that you might want to check out.

Download here - http://technet.microsoft.com/en-us/sysinternals/bb963907.aspx

Once you connect to your domain, you can browse down to the user and see the specific attributes. Then right click and Modify the selected attribute.

-1

Note that lastLogonTimestamp is not replicated - each DC holds its own value. To get a true picture of a person's last logon, you'll need to gather the value from each DC and determine which is the latest.

3
  • 1
    The lastLogonTimestamp is replicated, perhaps not at the frequency one might expect, it's the lastLogon attribute that is not replicated. I think your answer may have been better suited as a comment.
    – jscott
    Nov 8, 2010 at 18:49
  • OK, not reliably replicated. You can't make account status changes based on one DC's value. Been there. Plus, you need to account for occasions when a DC will randomly return a NULL. Haven't got to the bottom of this one yet (Win2k3 SP2 R2). Nov 8, 2010 at 20:11
  • There is only one domain controller, so in this case I will be "safe" :) Nov 9, 2010 at 9:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .