After some research:
LastLogonTimestamp is updated with the following logon types: Interactive, Network, and Service logons.
However, the attribute isn't updated with EVERY logon...
There is another attribute
ms-DS-Logon-Time-Sync that controllers how often [in days] the
LastLogonTimestamp attribute is updated. The default value is 14 days and is set in code, so if you look at the value in ADSIEdit, you won't see it set.
So, the decision to update
LastLogonTimestamp is based off the current date, minus the value of
ms-DS-Logon-Time-Sync minus a random percentage (of 5). If the result is equal to or greater than
LastLogonTimestamp the attribute is updated and replicated to other DCs.
Walkthrough of a lastLogontimeStampUpdate update
- (Assuming the value of the ms-DS-Logon-Time-Sync-Interval is at the default of 14)
- User logs on to the domain
- The lastLogontimeStamp attribute value of the user is retrieved
- 14 - (Random percentage of 5) = X
- Current date - value of lastLogontimeStamp = Y
- X ≤ Y - update lastLognTimeStamp
- X > Y - do not update lastLogontimeStamp
Most of this was found at the following blog article from the Microsoft Directory Services team: The LastLogonTimeStamp Attribute” – “What it was designed for and how it works”
So, yes, you should see the attribute update, but only based off the timing described above.