I am junior sys admin perviously I was a computer programmer and I am assigned a task, clean up active directory.

I am advised by my supervisor that LastLogon is not the true indicator to disable or delete users because last logon time doesn't change for mac users.

Is it true? is there a turn on/off feature to log LastLogon for mac users? basically i want to disable users who hasn't logged in last 180 days. There all types of users in the network i.e. linux Windows Mac.


LastLogon should not be used because it is not replicated to other domain controllers. LastLogonTimestamp is the attribute to use. And the endpoint type does not matter.

  • I will use LastLogonTimestamp. Greg, If I get you right you are saying that regardless of endpoint type (type of operating system that user is using) active directory would record LastLogonTimestamp correctly (LastlogonTimestamp updates in active directory for every successful log in attempt) – gaten Jun 4 '18 at 3:23

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.