1

I'm trying to find out the origin of most recent "username" login. User's "LastLogonTimestamp" AD attribute equals to "131181645775731489". ADUC console shows it as 9/12/2016 4:36:17 PM Romance Daylight Time. The funny thing is that if I get LastLogonDate and LastLogon user's attribute on each DC in the domain, I don't see 9/12/2016 anywhere. See the output.

Server  LastLogonDate     LastLogonTimestamp             LastLogon
DC03    02/18/16            [09/12/16]                  02/18/16
DC04    01/01/01            [09/12/16]                  01/01/01
DC05    01/01/01            [09/12/16]                  01/01/01
DC14    01/01/01            [09/12/16]                  01/01/01

There were no DC demotions recently. I have also parsed security logs on all domain controllers from the 09/12/2016 date and found no traces of "Username" logged in. Auditing is enabled and I can see other users login events. "Username" is the service account. Any ideas how can I find where it is used?
UPDATE
All domain controllers are Windows Server 2012 R2. Domain functional level is also Windows Server 2012 R2.

0

What OS version are you domain controllers, and what is the Domain Function Level of the domain?

An interactive GUI logon should update both logon time fields, but if the service account is only making LDAP queries, those will update lastLogonTimestamp but not lastLogon. See https://support.microsoft.com/en-us/kb/939899

Article says this can be corrected by raising DFL to 2003 mode.

|improve this answer|||||
  • Sorry, forgot to mention. All DCs are 2012 R2 and DFL is also Windows Server 2012 R2. – Vadym Rybitskyy Sep 14 '16 at 16:23
0

I have found the source of logins. It appears to be a Nagios monitoring user, which connects to SQL server to perform checks. In this case it leaves an event on the SQL server (see below), but not on the DC. So what helped me is parsing logs on domain member servers.

Log Name:      Application
Source:        MSSQL$INSTANCE
Date:          10/4/2016 10:10:06 PM
Event ID:      18453
Task Category: Logon
Level:         Information
Keywords:      Classic,Audit Success
User:          DOMAIN\username
Computer:      SQLSERVER.DOMAIN.COM
Description: Login succeeded for user 'DOMAIN\username'. Connection made using Windows authentication. [CLIENT: 10.0.0.4]
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.