I am developing a script to report on users who have not logged in to the domain for 6 months. I'm using lastLogonTimestamp as within 14 days is precise enough for my purposes, and I don't want to have to query each DC.

The problem is, when I run the script, the lastLogonTimestamp comes back blank for nearly 600 users. But, and here's the weird bit, I can then do Get-ADUser (which is what is used within the script to retrieve this information) for one of these users at the same prompt and it gives me a value.

What could be causing this?

UPDATE: Just to provide some clarification. Yes the DFL is 2003. Also, to clarify. I'm only referring to the lastLogonTimestamp attribute, not any other attribute.

The script begins by creating an object containing every user:

$userlist = Get-ADUser -Filter * -properties lastLogonTimestamp

Aside from some other logic, I write out each user to a text file by using a foreach ($user in $userlist) loop. Effectively

$name = $user.Name
$llts = $user.lastLogonTimestamp

When I review the text file, the lastLogonTimestamp is blank for nearly 600 users. Of some of these, I pick a test subject, for example someone who I know has logged on recently, let's say user-x. User-x will have lastLogonTimestamp blank in the text file. If, however, I then run

Get-ADUser user-x -properties lastLogonTimestamp

on the same command line after the script has completed for user-x, it returns a value for lastLogonTimestamp.

UPDATE 2: This makes no sense! I changed the script to pull the lastLogonTimestamp property in the loop rather than when I create the userlist object:

foreach ($user in $userlist)
$SamAccountName = $user.SamAccountName
$thisUser = Get-ADUser $SamAccountName -properties lastLogonTimeStamp


I thought this would more closely replicate what I'm using at the command line when it pulls the property successfully, but it still doesn't work. It's probably worth pointing out it's the same users every time.

  • Can you post the script you are using?
    – Mike
    Mar 7 '12 at 23:29
  • 1
    Yeah, I deleted my answer because it did not answer your question. I'm not able to reproduce the issue you're seeing using your exact steps. Sorry. :(
    – Ryan Ries
    Mar 8 '12 at 1:49
  • Is there a specific reason you don't want to query all the DCs? It's the only way you're going to get all of the information for every user. LastLogontimestamp data isn't necessary stored on every dc for every user. The reason some commands return that data is that they are built with that caveat in mind.
    – Tatas
    Mar 16 '12 at 19:24
  • 1
    @Tatas The lastLogonTimestamp attribute does replicate to all DCs, just not very quickly. Any user who has logged in at least once more than 14 days ago should have a value in this attribute. At least, that is my understanding from reading the docs.
    – pipTheGeek
    Mar 16 '12 at 19:33
  • @Matt - I assume you have checked that when you run the single statement it is using the same DC as when you run the loop? Or used ADSI edit to confirm what is actually in AD on the DC your script uses. Other thought, what error handling do you have in your script, is it possible that reading the attribute is failing?
    – pipTheGeek
    Mar 16 '12 at 19:37

The problem is with this statement in your Update 2

$SamAccountName = $user.SamAccountName

is that after you do this, the object type of $SamAccountName is System.String so you've lost the AD user context.
Try this:

get-aduser -filter * -properties lastLogonTimestamp | select name, lastLogonTimestamp |export-csv "output.csv"

For your previous code, the issue appears to be with other variable handling. A more substantial snippet will help us give a better answer

  • 1
    Yes our DFL is at 2003
    – Matt
    Mar 8 '12 at 2:40
  • My answer is updated
    – uSlackr
    Mar 8 '12 at 13:58
  • Thanks for the info, the script sample in update 2 was a typo, I've corrected it now.
    – Matt
    Mar 11 '12 at 20:58

Are you looping through all your domain controllers to get the true last logon time? This property and value is not synchronized across DCs IIRC. This is the function we use in our environment to retrieve the correct value for a single user:

function func_ad.getLastLogon

$dcs = Get-ADDomainController -Filter {Name -like "*"}
$time = 0
foreach($dc in $dcs)
    $hostname = $dc.HostName
    $userResult = Get-ADUser -Identity $username -properties lastLogon -Server $hostname
    if($userResult.LastLogon -gt $time) 
        $time = $userResult.LastLogon
$dt = [DateTime]::FromFileTime($time)
return $dt

In your case, to avoid unnecessary duplication I'd place Get-ADDomainController outside the function, but pass the array of DCs to the function along with the username. You could even modify the $username param to accept an array....

  • This is a good answer, need to add -server $hostname to the get-aduser line.
    – Nixphoe
    Aug 16 '18 at 14:41

I encountered this same issue and what I found helped was running it as an administrator. it doesn't make any sense, since the information should be available to any authenticated user, but there it is.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.